Models are not the control
A detection model can rank events. It does not replace the control that should have blocked them.
Ranking is useful. A block still has to be a block. This note keeps those two jobs separate.
A detection model can rank events. It does not replace the control that should have blocked them.
Ranking is useful. A block still has to be a block. This note keeps those two jobs separate.