Detection Watch

The Detection Watch improves your detection rules at the source, instead of handling the alerts they produce one by one.

Worker	What it does	Works with
Rule Tuning	Tunes rules that produce too many false positives.	The Alert Triage Worker in the Triage Watch, whose false positive closures this Worker counts, along with the ones people make.
Rule Coverage	Proposes rules to close detection gaps.	The Continuous Threat Hunt Worker in the Hunt Watch, which finds the detection gaps this Worker proposes rules for.

You review the Watch's proposed changes and rules in the Configure section of the Proposed actions page. Neither Worker offers Supervised autonomy, so you approve every change before it reaches your rules. To learn how to approve a rule change or a new rule, refer to Decide a detection change.

When to turn on the Detection Watch

Turn on the Detection Watch when noisy rules or missing detections cost your team time:

Turn on the Rule Tuning Worker when a few rules produce most of your false positives. To learn whether your rules and data are a good fit, refer to when to use Rule Tuning.
Turn on the Rule Coverage Worker together with the Hunt Watch, because it works only on the detection gaps that Watch records. To learn whether it fits your environment, refer to when to use Rule Coverage.