Field drift

Field drift is when the fields a rule depends on change name, type or meaning, or stop appearing, so the rule quietly stops matching. It often follows a parser update, a vendor log format change or a new agent version. The rule looks fine and sees nothing.

What Field drift means here

Catching drift means checking the fields a rule uses against the data arriving now. An alert tied to rule fields is different from a check on a whole index.

In the documents read for this site, no product documents an alert tied to the fields a rule uses.

Example of Field drift in Cribl (CardinalOps) documentation

Cribl's post on its CardinalOps deal says roughly one in eight detections can fail silently, citing schema drift, filter changes or mismatched data models and event types (vendor claim, no method). cribl.io read 2026-11-03

Terms related to Field drift

• Schema change: A schema change is an edit to how log fields are named, typed or nested, whether in the source system, the parser or the normalisation layer.
• Silent rule: A silent rule is a detection that stops producing alerts because it is failing, disabled or starved of data, not because there is nothing to find.
• Rule health: Rule health is whether a detection still runs, still sees its data and still earns its alerts.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.