Skip to content

Calculator

Alert precision calculator for rare events

How many of a monitor's alerts are real when the event it watches for is rare: precision from the base rate and the monitor's error rates.

InteractiveAlert precision at production base rates
0.10% · 1 in 1,000
100,000
99.0%
1.0%

Alerts that are real

9.0%

Pr[danger | alert]. About 10 false alarms for every real one.

Alerts per day

1,098

99 true alerts + 999 false alarms.

Missed events per day

1.0

Of 100 dangerous events a day (1 − TPR = 1.0%).

Pr[danger | alert] = fracp tp t + (1-p) f
0%25%50%75%100%0.001%0.01%0.1%1%10%100%Base rate p (log scale) · current 1 in 1,000Alerts that are real9.0% real
  • This monitor
  • Same TPR, FPR ÷ 10

Assumes the TPR and FPR measured offline hold on production traffic, and that events are independent. Counts are expected values per day.

At a base rate of 1 in 1,000, a monitor that catches 99.0% of dangerous events with a 1.0% false-positive rate raises about 1,098 alerts a day, and 9.0% of them are real. The monitor-control regime has a different estimand and operating point from a benchmark: validate and calibrate at the production base rate, not on a balanced test set. Count the cost of false alarms, too: reviewers who mostly see noise stop looking. And where a property can be guaranteed by construction (a permission that does not exist, an action that cannot be reached), a structural control beats any statistical monitor.

A monitor with a 1% false-positive rate sounds accurate until the event it watches for happens once in ten thousand checks. Alert precision is the share of alerts that are real at the production base rate. Set the base rate, the volume of checks and the monitor's error rates to see how many alerts are real and how many events slip through.

What it computes#

With base rate pp of truly dangerous events, true-positive rate tt on dangerous events and false-positive rate ff on harmless ones,

Pr⁡[danger∣alert]=p tp t+(1−p) f\Pr[\text{danger} \mid \text{alert}] = \frac{p\,t}{p\,t + (1 - p)\,f}

When pp is tiny, the (1−p) f(1 - p)\,f term dominates, so even a small false-positive rate can make most alerts false alarms.

What follows#

  • Validate a monitor at the production base rate, not on a balanced test set: precision measured at equal prevalence does not transport.
  • The calculator also counts alerts and missed events per day at your volume, which is what the people answering the alerts experience.

The chapter Monitoring and control in production puts this arithmetic to work.

Terms on this page

The chapter behind it

Handbook · RegimeMonitoring and control in productionMonitoring is not continuous benchmarking: base rates, calibration, conformal caveats, and the moment a monitor becomes a training signal.

More calculators