APP-002 / DETECTION ENGINEERING

Abnormal account data volume

A successful query accesses at least 1,000 records. Normal synthetic queries access no more than 90.

High

Effective rule · version 1

Repository baseline · read-only public demo

Approved local revisions affect subsequent scenario replays. The canonical Atlas investigation and its historical alert counts are preserved.

Effective ruleset provenance

Generation 0

50adf11d9eb16a29ded57ecd8b457cc89b8a946106c8b87137a8c85d8d9d0216

Three fixed APP-002 comparisons, computed from the same synthetic corpus

These fixed examples cannot save proposals or approve changes. Each example compares the repository baseline against one bounded threshold.

Computing fixture comparison…