Backtest

A backtest is a replay with a report: the rule runs over a stated period of past data and the result is kept as a record of alerts, matches and timing. It turns a one-off check into evidence you can attach to a change. Few products document a saved backtest report.

What Backtest means here

The useful outputs are alert count, which entities matched and how the count compares with the previous version of the rule. That comparison is what lets a reviewer approve a change with numbers.

Check whether the product saves the result. If it does not, export or screenshot it into the review.

Example of Backtest in Sekoia documentation

Sekoia's Test results visualization shows detection frequency and event distribution for a rule tested on historical data, and the docs do not describe saving it as a report. docs.sekoia.com read 2026-11-03

Terms related to Backtest

• Replay: Replay runs a rule over historical data to see what it would have alerted on.
• Rule unit test: A rule unit test runs a detection against a small set of sample events and checks whether it alerts on the ones it should and stays quiet on the others.
• Tuning: Tuning is adjusting a rule so it keeps its true positives and drops its false ones: tighter conditions, exclusions or thresholds.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.