Patent ID: 8402537

Claim:
A method implemented at least in part by a computer, the method comprising: determining an effect on alerts of making an adjustment to a parameter of a security system by using at least a history of the alerts and simulating the effect of the adjustment to the parameter on the history of the alerts, wherein determining an effect on alerts of making an adjustment to a parameter of a security system by using at least a history of the alerts further comprises determining a number of true positive alerts that would be missing from the history of alerts had the adjustment been made prior to the history of alerts being generated, and, determining a number of false positive alerts that would have been eliminated from the history of alerts had the adjustment been made prior to the alerts being generated; determining a cost associated with making the adjustment comprising increasing the cost based on the number of true positive alerts that would have been missing, and, decreasing the cost based on the number of false positive alerts that would have been eliminated; and determining a benefit associated with making the adjustment, the benefit related to the effect.