Skip to main content

Effectiveness

Lumetry's job is to turn a flood of raw signals into a short list of incidents worth acting on. The Effectiveness view measures how much of that reduction is actually happening in your environment, over any time range you choose. It is the place to answer the question a buyer or an operations lead asks first: how much noise did Lumetry remove?

The signal funnel​

Effectiveness presents detection as a funnel that narrows at each stage:

   many                    fewer                    fewest
 ┌──────────┐           ┌──────────┐            ┌──────────┐
 │SIGNALS IN│ ─dedup──▶ │  ALERTS  │ ─correlate▶│INCIDENTS │
 └──────────┘           └──────────┘            └──────────┘
  • Signals in — every raw metric breach plus every accepted transition from an external alert source. This is the volume an operator would otherwise face.
  • Alerts — the deduplicated operational alerts those signals collapse into.
  • Incidents — the correlated, topology-aware incidents that alerts are grouped into, i.e. the real operator workload.

Between each stage the view shows the compression percentage so you can see where the reduction comes from: deduplication first, correlation second.

Headline metrics​

  • Noise reduction — the overall reduction from signals in to incidents out.
  • Alerts → Incidents — how much correlation compresses the alert stream.
  • Mean time to acknowledge and mean time to resolve — how quickly the team responds to the incidents in the range, with the counts they are averaged over.

Funnel trend​

A chart plots signals, alerts, and incidents over the selected range so you can see how the funnel behaves over time — for example, whether a noisy period still resolved into a small number of incidents.

Choosing a range​

The view defaults to the last 7 days and offers the same relative presets and custom date range as the operational lists. The trend granularity (hourly or daily) is chosen automatically from the length of the range.

What it is — and isn't​

Effectiveness is read-only and deterministic: every number is derived directly from the alerts and incidents Lumetry already produced, with no estimation. It is distinct from the Overview, which shows current-state fleet health; Effectiveness reports the trend and the reduction achieved over a chosen window.

The numbers depend on how much of your estate Lumetry covers: environments with few rules or sparse service dependencies will show more modest compression, which is an honest reflection of the available signal rather than a limitation of the view.