Rule health

Rule health is whether a detection still runs, still sees its data and still earns its alerts. It covers noisy rules, silent rules, field drift, performance cost and deprecation. A rule can be correct in the repository and unhealthy in production.

What Rule health means here

The five checks are noisy rule detection, broken or silent rule detection, schema or field drift alerts, rule performance or cost telemetry and lifecycle states. Documenting all five is rare. Most products document one or two.

This site scores rule health as its own criterion at 18 of 100 points, because the failure it describes is the one a detection team meets most often.

Example of Rule health in Microsoft Sentinel documentation

Sentinel's SentinelHealth table records whether rule runs succeeded or failed and why, and a documented query lists auto-disabled scheduled analytics rules. learn.microsoft.com read 2026-11-03

Terms related to Rule health

• Noisy rule: A noisy rule fires far more often than it finds anything real, burying analysts in alerts.
• Silent rule: A silent rule is a detection that stops producing alerts because it is failing, disabled or starved of data, not because there is nothing to find.
• Field drift: Field drift is when the fields a rule depends on change name, type or meaning, or stop appearing, so the rule quietly stops matching.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.