triage-rule-hits

To triage false positives in Osprey rule execution results, you sample hits across a specified time window and classify them into true positive, false positive, novel, or uncertain categories to identify rule drift and actionable adjustments.

Rule drift occurs when detection rules lose accuracy due to emerging satire or historical references. You validate rules by sampling execution results and classifying hits to surface novel detection patterns and recommend keyword adjustments.

You run stratified sampling on Osprey rules by specifying a rule name, time window, and sample size. This automatically samples rule hits to ensure a representative view of rule behavior for your moderation investigation.

Performing statistical aggregation on Osprey rule hits requires access to osprey_execution_results and data-analyst dispatch capabilities to classify hits and generate aggregate health assessments.

You should use automated rule validation during Phase 5 of a data investigation to determine if a rule is drifting, allowing for precise rule tuning and keyword adjustments based on aggregate health assessments.