Replay

Replay runs a rule over historical data to see what it would have alerted on. It answers how noisy a rule will be and whether it catches what it should, using your own logs. Products call it retrohunt, manual rerun, data replay or test over a time range.

What Replay means here

The value of replay is volume. A rule that passes unit tests can still produce thousands of alerts a day on real traffic. Replay shows that before the rule pages anyone.

Replay results are not always kept. Some products show a result window and discard it, so record the outcome in the pull request.

Example of Replay in Microsoft Sentinel documentation

Sentinel documents a Manual rerun of analytics rules and a Results simulation option to test a query with current data, for testing and tuning a rule. learn.microsoft.com read 2026-11-03

Terms related to Replay

• Backtest: A backtest is a replay with a report: the rule runs over a stated period of past data and the result is kept as a record of alerts, matches and timing.
• Rule unit test: A rule unit test runs a detection against a small set of sample events and checks whether it alerts on the ones it should and stays quiet on the others.
• Tuning: Tuning is adjusting a rule so it keeps its true positives and drops its false ones: tighter conditions, exclusions or thresholds.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.