What it means
Recall asks how many of the real target events a detector found in a defined evaluation. The denominator includes both detected events and known missed events. That last part is difficult in production: teams usually do not know every attack they failed to notice. A controlled exercise can supply a known denominator, but its results apply to the tested scenarios and conditions. Recall complements precision, which describes how many positive results were correct. Both need a clear target behavior and consistent counting rules.
The idea at a glance / Detection
Of the attacks, how many were found?
Use the same reviewed population, but count every attack, including known misses.
Illustrative controlled exercise: 40 synthetic exports, each reviewed as authorized or unauthorized. One fixed detector rule targets unauthorized exports, called attacks here; each export either raises one alert or none.
READ THE PICTURE
Count the attacks
Use the same 40 reviewed exports: 12 unauthorized exports were found, 4 were missed, 8 authorized exports raised false alerts, and 16 stayed quiet. Recall counts all 16 unauthorized exports, including the misses. Twelve found divided by 16 is 75%; false alerts are outside this denominator.
Keep in mindReal undetected events are often unknown. These labels are assumed known in one controlled exercise; the result does not establish recall for every real attack.
AN ILLUSTRATIVE SCENARIO
Testing suspicious data-export detection
A school district creates twenty authorized test cases representing the export behavior its rule should detect. The detector catches fifteen and misses five, giving seventy-five percent recall for that exercise. The team finds that four misses used an application whose export logs were not connected. Adding the source is a concrete improvement, but the team does not claim seventy-five percent recall for every real-world data theft technique or every district application.
Put it to work
- Define the target event and construct representative, authorized test cases with known outcomes. Include relevant systems, identities, and variations instead of repeating one easy case.
- Count true positives and false negatives using the same unit. Record why each missed case was missed, separating missing telemetry from rule logic and operational handling.
- Calculate TP divided by TP plus FN and report the scope, sample size, and conditions. Retest after improvements, and inspect precision so added coverage does not create unusable noise.
How to check your work
Ask a colleague to reconcile every known positive test case with a detected or missed result. Check that an alert arriving too late for the stated objective is handled consistently and that limitations accompany the reported percentage.
Connect the ideas
- Precision
True positives divided by all positive alerts in a defined, labeled evaluation set: TP / (TP + FP).
- False positive
An alert that did not represent the harmful event the detector was meant to catch.
- Coverage
An explicit statement of which sources, time windows, and rows were actually collected, including truncation.
- Log
A record emitted by a system that something happened, which may later be used as evidence.