An Incident Isn't an Event. It's a Definition.

Two evenings to build ingestion. Three weeks to decide what counts as an incident. TL;DR : Building a log analysis tool, ingestion takes two evenings. Deciding what counts as an incident takes weeks. This post walks through three rules — a fingerprint, a threshold, and a reopen window — and the trade-offs each one forces. In this post: What makes two logs the same incident? How many occurrences make an incident? When is an incident closed? Where the rules stop Why detection is the hard part When