3 ms·

I guess he doesn't mean that he detected all infected machines but that near 100% of machines which triggered the alarm were indeed infected.

• antoinealb 9y ago
  That's a bad metric though. You could miss a lot of infected hosts.
  • bauerd 9y ago
    Outbound traffic probably wasn't their only heuristic
  • marcosdumay 9y ago
    That is the single most important metric when you want to create an alert.