What it means
Recall asks how many of the real target events a detector found in a defined evaluation. The denominator includes both detected events and known missed events. That last part is difficult in production: teams usually do not know every attack they failed to notice. A controlled exercise can supply a known denominator, but its results apply to the tested scenarios and conditions. Recall complements precision, which describes how many positive results were correct. Both need a clear target behavior and consistent counting rules.
AN ILLUSTRATIVE SCENARIO
Testing suspicious data-export detection
A school district creates twenty authorized test cases representing the export behavior its rule should detect. The detector catches fifteen and misses five, giving seventy-five percent recall for that exercise. The team finds that four misses used an application whose export logs were not connected. Adding the source is a concrete improvement, but the team does not claim seventy-five percent recall for every real-world data theft technique or every district application.
Put it to work
- Define the target event and construct representative, authorized test cases with known outcomes. Include relevant systems, identities, and variations instead of repeating one easy case.
- Count true positives and false negatives using the same unit. Record why each missed case was missed, separating missing telemetry from rule logic and operational handling.
- Calculate TP divided by TP plus FN and report the scope, sample size, and conditions. Retest after improvements, and inspect precision so added coverage does not create unusable noise.
How to check your work
Ask a colleague to reconcile every known positive test case with a detected or missed result. Check that an alert arriving too late for the stated objective is handled consistently and that limitations accompany the reported percentage.
Connect the ideas
- Precision
True positives divided by all positive alerts in a defined, labeled evaluation set: TP / (TP + FP).
- False positive
An alert that did not represent the harmful event the detector was meant to catch.
- Coverage
An explicit statement of which sources, time windows, and rows were actually collected, including truncation.
- Log
A record emitted by a system that something happened, which may later be used as evidence.