Data Assurance overview

Whether your use cases can be trusted: how many can fire, how much of the alerting is noise, and what is proven by a test.

Trusted use cases, cannot fire, percent noise, true positive rate, runs that did not finish and techniques tested.

Use case states

Healthy	It can fire and fires within your limit
Quiet	Vyrux ran it and it can fire. Nothing matched yet
Not proven	It has not fired, and Vyrux has not yet proven it can
Over-firing	It fires more than your limit, 3 alerts a day by default
Broken	It cannot fire: a field, log, macro, lookup or index it needs is missing, or the search cannot run
Disabled	Switched off in Splunk