Traditional alerting fires on every single suspicious event, drowning analysts in noise. Risk-Based Alerting (RBA) takes a fundamentally different approach.
Instead of alerting on each low-fidelity event, RBA attributes a risk score to a Risk Object (a user or system). Only when the accumulated risk crosses a threshold does a single "Risk Notable" fire, dramatically reducing alert fatigue while increasing fidelity.
Low-fidelity event A (+10 risk) → user "jdoe"
Low-fidelity event B (+15 risk) → user "jdoe"
Low-fidelity event C (+25 risk) → user "jdoe"
→ Threshold (50) exceeded → Risk Notable fires for "jdoe"