The destination check compares classes, and that leaves one wolf your table would wave through: a tampered backup job. Same job ID, same orchestrator process, same hour, with the destination changed from backup-srv-02 to another internal host the attacker controls. Host, job and process all match, internal equals internal, and the case stays green. Staging data on an internal box before moving it out is a common step in exfiltration, so it's worth covering. Comparing the exact destination for scheduled jobs, with the class as a fallback for everything else, would catch it. Backup targets change rarely enough that a new one deserves a look.
The second thing I'd watch is the review load. At 75% of alerts needing a person, the human-confirmed gate on retention is only as good as the attention behind each confirmation, and tired analysts confirm quickly. One cheap check: retain a confirmation only if the rationale mentions each key signal that differed. That keeps a hurried "looks fine" out of the memory bank.
Putting the 17 in 40 beside the zero false greens is what made the evaluation worth reading.
Kartik N V J K
AI Developer | Making AI reliable, trustworthy & accessible to everyone | Active community contributor
I like that the detection hinges on the 2 decisive signals, external IP and unfamiliar process, rather than the 3 that happily matched a benign backup, that's the difference between a rule and a heuristic that pages all night. Building it on agent memory so it recalls what actually worked is the part I'd want in my incident tooling. How do you keep those decisive signals from drifting as normal behavior changes?