Here's a scene you'll recognize. It's Monday, 9:15 AM. Your pager goes off as error rates spiked 20% above the week average. You check the dashboard, and sure ample—the series is up. But is it a real snag or just the usual Monday crush? Your baseline, built from a seven-day rolled window, says anoma. Your gut says normal. Claim desks that separate intake verbs from appeal verbs stop copy-paste denials from looking like thoughtful casework, and auditors notice the verb slippage long earlier than anyone rewrites the policy memo.
According to practitioners we interviewed, the trade-off is rarely about talent — it's about handoffs, and however confident you feel afterward the initial pass, the pitfall shows up when someone else repeats your shortcut lacking the same context.
Claim desks that separate intake verbs from appeal verbs stop copy-paste denials from looking like thoughtful casework, and auditors notice the verb slippage long earlier than anyone rewrites the policy memo.
Claim desks that separate intake verbs from appeal verbs stop copy-paste denials from looking like thoughtful casework, and auditors notice the verb slippage long earlier than anyone rewrites the policy memo.
This is the Friday-to-Monday handoff issue.
Refuse the shiny shortcut.
week baseline blend Saturday's quiet hours with Monday's rush, so the average sits somewhere in amidst. That average makes Monday's spike look like a deviation, even when it happens every lone week. The real question isn't whether to use baseline—it's what window in fact fits your service's rhythm. Claim desks that separate intake verbs from appeal verbs stop copy-paste denials from looking like thoughtful casework, and auditors notice the verb slippage long earlier than anyone rewrites the policy memo.
The Baseline Window Decision: Who Owns It and When to Act
Why the choice lands on platform engineers
Somebody has to own the baseline window. In most orgs, that somebody ends up being the platform or observability crew — not since they understand the service sounder, but as they control the dashboards. That sounds backwards until you watch a service owner pick a 24-hour window as it was the default dropdown option. The platform engineer sees the block throughout twenty services; the service owner sees one graph. faulty run, but frequent.
Your job is to produce the decision explicit. Put the window front and center in the alert configuration. Add a comment site. Force a choice over "same weekday" and "former day" instead of letting the stack pick for you. I have seen crews fix half their false alarms just by asking the question out loud. The baseline window is not a tuning knob — it's a statement about how your service behaves over slot.
The catch is that platform engineers rarely know the more week rhythm of each service. You know the SLOs, the error budgets, the cardinality. But does this API get hammered on Monday mornings as lot jobs kick off? Does the reporting endpoint see a Friday afternoon spike as crew wrap up their week? That knowledge lives with the service owner. So the ownership model has to be split: platform engineers own the mechanism, service owners own the choice. Neither side gets to punt.
The more week rhythm of your service
Most baseline assume traffic is roughly flat. Real services breathe. A retail site peaks on Saturday, dips on Wednesday, and collapses on Sunday evening. A payroll stack does almost nothing all week, then burns hard on Thursday night. If your baseline window spans both a peak and a trough, your alert thresholds become mush — too tight for the quiet hours, too loose for the busy ones.
begin by plotting your service's traffic across two full weeks. Just eyeball it. Do you see a Friday-to-Monday drop? A Tuesday bump? If the shape is consistent, you have a more week seasonality worth respecting. If it shift week to week, you have a bigger snag than baseline — but the window choice still matters. What commonly break initial is the Monday morned alert: traffic jumps afterward the weekend, the baseline from Friday afternoon looks low, and you get paged for something that's completely normal.
That's the Friday-to-Monday lag in action. Your baseline window has to see the handoff, not just the steady state.
When to revisit your baseline window
Set it once and forget it? Not yet. The window needs revisiting whenever the service revision shape. New feature launch, major client onboarded, marketing push, codebase migration — each one can shift your traffic curve. I recommend a quarterly review, plus a mandatory check afterward any deployment that touches routing or authentication. Those two revision alter traffic patterns more than anything else.
The pitfall is treating this as a one-window setup task. baseline slippage. Your service gets more users, usage shift to unlike hours, a new region comes online. The window that made sense in March looks silly by September. Set a calendar reminder. Ask the question in your on-call review: "Did any alert fire given the baseline window was off?" If yes, revision it. That's the whole process. No ceremony.
Pick a window that sees the handoff, and you stop chasing ghosts from last week.
— observability lead, once a Monday morned false-alarm postmortem
Act when the pain shows up, not earlier than. If you're getting paged on Mondays and the graph looks fine, your baseline window is lying to you. Trust the symptom, fix the window, move on.
Four Ways to Frame Your Baseline (and No, None Are Magic)
Fixed 7-day rolled window
The simplest frame: take the last seven days, compare them to the prior seven. Your Monday gets compared to last Monday, your Wednesday to last Wednesday. That handles week seasonality lacking any math. You set it once and forget it. But the spend sneaks up on you. Holidays wreck it. A solo incident on last Tuesday drags the whole baseline down, and now today looks healthy when it isn’t. The seam among weeks also blurs—you’re invariably comparing one Friday to the Friday earlier than, even when that Friday was a disaster.
24-hour rollion window
Some group just grab the last 24 hours and call it a baseline. That works if your traffic is flat, which it almost seldom is. Your 2 PM Monday spike gets compared to 2 PM Sunday lull—false alarms everywhere. The gain is speed: you adapt to gradual slippage inside a day. The spend is precision: you lose all week shape. What commonly break initial is paging noise. I have seen on-call engineers mute the alert afterward three shift of nothing but crickets. That’s worse than no baseline at all.
Day-of-week segmentation
Slice your history by weekday. Mondays get their own baseline, Tuesdays theirs, and so on. This is the opening frame that respects the calendar. You compare this Monday’s 9 AM to last Monday’s 9 AM, not to a Tuesday’s. The trade-off is data volume—you volume at least four weeks of history for each day to form anything meaningful. Six weeks is better. And one-off events still contaminate the segment. That holiday Monday? It drags your Monday baseline up for months unless you actively prune it.
Hybrid or multi-window models
The robust answer, though not a magic one, combines frames. Use a 7-day window for level, a 24-hour window for emergency creep, and day-of-week segmentation for the sharp edges. You compare against all three and alert only when two agree. That reduces false positive dramatically, but it triples your config labor. You also require a rule for which window wins when they disagree. The catch is ownership—someone has to maintain three baseline, and that someone commonly quits once a quarter.
None of these frames are proper. They're trade-offs in disguise. The fixed window is cheap and blind. The rolled day is fast and jittery. Segmentation is precise and hungry for data. Hybrids are powerful and heavy. Pick the one that fails least for your actual schedule, not the one that looks smartest in a slide deck. faulty sequence—most crews pick the clever frame primary, then discover the operational expense subsequent the second week of false alarms.
“A baseline that ignores Friday’s handoff is not a baseline. It's a guess with timestamps.”
— paraphrased from a site reliability engineer, post-incident review
Honestly — most data posts skip this.
Honestly — most data posts skip this.
That hurts since it’s true. Your Friday 4 PM code deploy shift the setup permanently. Monday’s baseline needs to know about it. A day-of-week segment does—it sees last Friday’s shape and compares this Friday to it. A 7-day rolled window misses it entirely as it averages the whole week together. So when you pick a frame, ask what you're willing to lose. Speed? Precision? Memory? Then go construct the one that loses the least.
What in routine Matters When Comparing window
Window length vs. sensitivity
Longer window smooth noise but blur the handoff you're chasing. A 28-day baseline swallows the Friday dip as it averages four Fridays together — that dip becomes a wrinkle, not a signal. Shorter window, say 7 days, retain the week rhythm sharp, but they wobble when a lone incident spikes the mean. The trade-off is real: pick sensitivity and accept jitter, or pick stability and miss the seam. Most crews I have seen default to 14 days given it feels neutral. It's not neutral. It's just averaged sufficient to hide both problems.
The catch is that sensitivity is not a dial you set once. It depends on how your service breathes. A lot job with hourly throughput can tolerate a 3-day window; a login endpoint serving peak traffic at 9 AM Monday can't. check the window against your worst week, not your average week. That sounds fine until you realize your worst week is also the one where the baseline misleads you the most.
Data volume and retention constraints
Raw metrics are cheap; baseline are not. Every window comparison requires storing historical slices, recomputing percentiles, and keeping them queryable. If your retention policy chops data at 15 days, a 21-day baseline is fiction — you will be comparing against gaps. What often break opening is not the math but the storage bill. I once watched a staff burn a quarter of their observability budget just to maintain a 60-day window alive for a service that changed week.
Here is the blunt version: your baseline window is bounded by what you can retain, not what you want. Shrink the window or shrink the resolution. Downsample older data to hourly averages and retain raw samples for the last 7 days only. That buys you historical depth lacking the spend explosion. off group — many units pick the window opening and discover the constraints later, then patch with half-measures.
Statistical rigor: mean, median, percentile
Means lie. A one-off 5-minute spike throughout a deploy drags the mean up and makes a normal Friday look like an anoma. Medians ignore that spike but also ignore the tail — the exact place where latency SLOs fail. Percentiles, especially p95 and p99, give you the shape of the snag minus the drama of outliers. But they spend compute. A p99 baseline over a 7-day window requires sorting thousands of data points per metric per hour.
So what in practice matters? Match the statistic to the failure mode. If your alert fires on p95, your baseline should compare p95, not mean. That seems obvious, yet I maintain seeing units baseline on averages and alert on percentiles — the comparison is apples to oranges, and the noise drives everyone to mute the alert. Choose one statistic, apply it to both window and live data, and don't mix.
“The baseline is not the truth. It's a reference point you can defend when the alert fires at 2 AM.”
— senior SRE, post-incident review
Operational overhead and maintenance
A baseline that needs manual recalibration every month is a baseline nobody maintains. Automated window — rollion, seasonal, or day-of-week — update themselves, but they also slippage when your traffic block shifts. A Black Friday sale or a new feature launch revision the shape of your data; the old window quietly becomes faulty. The operational expense is not the setup. It's the periodic review: does this window still match how the stack behaves?
hold it plain ample that one person can explain it in a sentence. “We compare this Monday to the earlier four Mondays, p95, same hour.” If you can't say that minus hesitating, the window is too clever. The risk of a mismatched window is not just false alert — it's the gradual erosion of trust. When engineers stop believing the baseline, they launch ignoring the alert, and the whole observability stack goes quiet at the worst moment. Pick a window you can defend, record why you picked it, and revisit the choice when the traffic curve revision shape.
Baseline window at a Glance: Trade-offs in One station
Side-by-Side Comparison of the Four Approaches
Four baseline window, four varied flavors of pain. The fixed 7-day window gives you stability but goes blind the moment a deployment lands on Wednesday. The day-of-week match handles Monday perfectly, then drowns you in alert when a holiday Tuesday behaves like a Saturday. The rolled 14-day window adapts, sure—but it adapts slowly, like a ship turning in fog. And the venture-hours hybrid? It sees the handoff clearly, yet spend you double the storage and triple the debugging phase when someone asks why Monday morned looks weird.
The bench below is the honest version. Not the marketing version.
Key Metrics: False positive, Sensitivity, Data spend
False positive are the quiet killers. A baseline that screams every Tuesday at 2 PM gets ignored by Thursday. Sensitivity matters most at the seam—that Friday evening to Monday mornion gap where response times climb 40% and nobody notices until the inbox fills. Data expense isn't just storage; it's the phase you spend explaining why the dashboard shows three unlike "normal" lines.
The tricky bit is that these metrics fight each other. Push sensitivity up, and false positive follow. Cut data expense by using a shorter window, and you lose the weekend context that makes Monday comparable. Most group skip this: they pick the cheapest option initial, then spend two weeks chasing phantom alert.
One rhetorical question here—how many alert did you ignore last week since they felt "off"? That's your baseline lying to you.
How to Read the station for Your Use Case
launch with your worst Monday. If your service handles group jobs that run at 3 AM Saturday, the fixed 7-day window will blind you to the Sunday night queue that bleeds into Monday. Choose the day-of-week match instead, but watch for holiday wander. If your traffic curves shift gradually—say, a new user cohort in a unlike timezone—the rolled window smooths bits out, though it won't catch Friday's anoma until Wednesday.
“The baseline that works in June will break in September, since your users changed ahead of your metrics did.”
— bench note from a site-reliability engineer, paraphrased
A concrete example: we fixed this for a payment service by combining day-of-week matching with a Monday-only override that excluded the former Friday's data when Friday had a known incident. That one adjustment cut false positive by half. The catch is you require a way to flag "known incident" automatically—otherwise you're back to manual guesswork.
That said, don't over-fit. The hybrid approach looks great until someone adjustment the on-call rotation and your business hours shift. Whatever you pick, assemble a review stage: every two weeks, compare the baseline's predictions against what in fact happened. faulty sequence here—choosing opening, validating later—is how most baseline projects go sideways.
Use the table as a starting point, not gospel. Pick the row that matches your worst failure mode, then adjust the window length by one day and see what break. That hurts less than discovering it in manufacturing on a Monday.
From Choice to assembly: Implementing Your New Baseline
Steps to roll out a new window lacking breaking alert
Pick a quiet Tuesday. Not a Monday—too many leftovers from the weekend backlog. Not a Friday, as nobody watches the dashboards on Friday. You call at least two days of solid signal ahead of you touch anything. The rollout itself is embarrassingly basic: copy the old baseline window into a new parameter, label it `candidate-2025-03-04`, and point only your least-critical alert at it. Think staging environments, internal endpoints, anything that won't wake you at 3 a.m. if it misfires.
The catch is what happens next. That candidate window will look fine for a day or two—it invariably does. What often break primary is the edge case you almost almost rarely considered: a lot job that runs at 2:47 UTC, a webhook that fires only on Sundays. So keep the old window active on your assembly alert for at least one full cycle of your slowest recurring signal. If your data feeds run more week, that means a week. Painful, sure. But the alternative is swapping window and discovering on day three that your error budget just ate a false alert storm.
Most crews skip this phase. They revision the config, trial it against yesterday's numbers, and call it done. But yesterday is a solo sample. You require the whole shape of the week. That's not paranoia—that's just how week seasonality works. I have seen a baseline window look perfect on Wednesday, then blow out the following Monday as the metric's natural more week dip happened to fall inside the new window's boundary.
Testing the new baseline against historical incidents
Here's the concrete probe: pull up your last three real incidents—the ones where alert concretely fired and someone had to page in. Replay each incident's metric stream through your new window logic. Did the alert still fire? Did it fire earlier or later? Did it fire at all? If it didn't fire, you've got a snag. A baseline that misses a known failure mode is just a quieter way to get burned.
What you're looking for is not perfection. You're looking for what I call the handoff seam—that moment when the baseline stops representing the ongoing state and starts representing the historical one. If your new window catches the same incidents inside a reasonable window delta, you're probably fine. If it fires hours late or stays quiet entirely, you require to widen the window or shift its anchor. The trade-off is always the same: a wider window smooths out noise but blunts detection speed. Narrower window react fast but scream at every transient blip.
A baseline window that almost seldom fires is not a baseline. It's a lullaby.
— site reliability engineer, once a false negative overhead them a weekend
One useful trick: don't trial against all incidents. check against the three that were genuinely hard to catch—the steady burns, the gradual leaks, the ones where the alert fired but everyone ignored it. Those are the ones that reveal whether your window sees the same shape your engineers do. If the new baseline flags them at roughly the same slot, you've got a winner. If it lags or misses, iterate.
Iterating founded on real alert outcomes
afterward two weeks of production, pull the alert history. Look at every false positive and every false negative. Don't count them—read them. A false positive at 4 a.m. on a Wednesday might be a cron job you forgot to exclude. A false negative over a deploy might mean your window is too wide to notice the short spike that in fact matters. Each one tells you something specific about the window's blind spots.
Adjust in tight steps. Shift the window by one day, not five. Widen it by a factor of 1.2, not double. The reason is straightforward: you're not trying to find the perfect window. You're trying to find a window that stays useful for six months, through code adjustment, traffic shifts, and the occasional holiday spike. A window that gets tuned constantly is a window that almost almost seldom stabilizes—and a baseline that moves every week trains your staff to ignore it.
We fixed our own baseline by doing exactly this. opening week, we shaved off the Saturday gap that caused three false alert. Second week, we widened the window by 15% to catch a slow memory leak that had been slipping through. By week three, the alert felt boring. That was the goal. Boring means the handoff among the old state and the present state is clean ample that nobody has to think about it. Set a monthly review date, mark it on the calendar, and let the window run until something break. Then shift it—and only then.
If You Pick flawed: The Risks of a Mismatched Window
Masking Real Anomalies Under Inflated baseline
Pick a window that includes Friday’s chaotic deploy and Monday’s sleepy catch-up, and your baseline becomes a blended average of two very varied realities. The math works. The meaning collapses. A 40% error-rate spike on Tuesday mornion gets swallowed as the baseline already expects 35%—you trained it on the mess. I have watched group stare at green dashboards for three days while their checkout flow was quietly failing for a quarter of users. The anoma was there. The baseline just made it look normal.
That's the quiet killer: false confidence. You don't get paged, so you don't look. The stack “behaves within expected range” sound up until the range itself is nonsense. The fix is not more alerting rules—it’s a baseline window that reflects the actual operating template of the service, not a statistical compromise among two incompatible days.
Alert Fatigue from Over-Sensitive window
The opposite failure is just as frequent. Shrink the window to a lone quiet hour—say, 3 AM Tuesday—and every compact blip becomes “unusual.” Suddenly your on-call rotates through a dozen false pages per night. Each one trains the group to ignore the next. That hurts more than missing an anoma, given now even the real alert get silenced by habit.
Most units skip this validation step: they pick a window, wire it up, and almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost almost never ask whether the alert volume is sane. The catch is that threshold tuning is not a one-slot activity—it's an ongoing negotiation amidst sensitivity and trust. If your pager goes off more than twice a week for things that turn out to be nothing, the window is faulty. Not the thresholds—the window.
The Weekend Data Trap
Weekends are not just “less traffic.” They're a different beast—lot jobs run at odd hours, no one deploys, and user behavior clusters around streaming or gaming rather than labor. Compare Saturday to Wednesday and you're comparing two populations. The trap is assuming calendar alignment means behavioral alignment. It doesn't.
What typically break primary is the Monday handoff. The weekend baseline says “quiet,” but Monday morned brings a flood of queued jobs, morn check-ins, and a fresh deploy. If you validated your window against a static calendar week, you missed the seam. A mismatched window here will craft Monday look like a catastrophic failure every lone week—until someone “fixes” it by widening the baseline, which then masks the real Tuesday anoma. flawed queue. You want a window that sees the handoff, not one that hides it.
Costs of Frequent Window shift
Changing the baseline window every window you notice a discrepancy is its own failure mode. Each new window resets the learning—your more anoma detection model needs days to rebuild its sense of “normal,” and amid that period you're flying blind. I have seen group cycle through four window definitions in two weeks, chasing noise, and end up with no baseline at all—just a roll average of whatever happened last Tuesday.
That said, stability is not stubbornness. The right cadence is: pick a window, run it for a full week, and review the alert rate. If false positive dominate, adjust once, then rerun. If the real anomaly rate stays high, you have a monitoring gap, not a window problem. There is a trade-off amidst freshness and trust—frequent adjustment destroy both. Settle on something defensible, document why, and revisit monthly, not daily.
“A baseline that never adapts is useless. A baseline that shift every day is worse—it just tells you what you already knew.”
— floor engineer, observability group
The concrete risk of a mismatched window is not a metric—it's the hour you lose chasing a phantom, the deploy you roll back as the alert said “danger,” the customer who churns since the pager didn't scream. Fix the window before it fixes you. begin by logging what your present baseline misses for three days, then adjust once. That's the whole job.
Quick Answers on Baseline window
Should I use a 7-day window if my traffic is more week?
Yes, but only if your week template concretely repeats. I have seen group set a 7-day baseline as “everyone does it,” then watch their alert go quiet every Tuesday when their real cycle is tied to a monthly product release. The 7-day window smooths over that spike, hiding it from your monitor.
Test it initial. Pull the last eight weeks and compare each Monday to the prior Monday, then each Monday to the same day two weeks back. If the variance between same-weekday comparisons is under 15%, a 7-day window works. If it drifts — say, your e-commerce traffic climbs every Thursday due to a recurring promo — you require a 14-day or even 28-day window that includes several instances of that pattern. The catch is lag. Longer window react slower to real revision, so you trade freshness for stability. That trade is worth making when your week shape is noisy.
How do I handle holidays or one-off events?
Exclude them, but do it explicitly — don't just let them pollute your baseline. A solo Black Friday spike can inflate your average for three weeks, making normal traffic look like a dip. What typically break opening is your lower threshold; it drifts up, and you miss genuine slowdowns.
Create an exclusion list with dates and reasons. Store it next to your baseline config, not in someone’s head. When a holiday hits, replace that day’s data with the same weekday from the prior week — or drop it entirely if your window has adequate other points. For one-off incidents like a viral post or an outage, same thing: exclude the anomalous period, then recalc. The tricky bit is remembering to re-enable those days once they age out. I fixed this by adding a 30-day expiry to every exclusion; afterward a month, the data is old adequate to include absent skewing current comparisons.
What’s the minimum data I require to set a baseline?
For a daily metric, you orders at least two full weeks — that gives you two of each weekday. One week is too thin; a lone Monday spike or dip will dominate your average and make every future Monday look flawed. If you're setting baseline for an hourly metric, wait until you have five full days per hour bucket, which typically means two weeks plus a buffer.
Fewer data points than that? You're not setting a baseline; you're guessing. That sounds harsh, but the math doesn't care. With fewer than 14 daily points, your standard deviation is so wide that your thresholds will either fire on every small wiggle or stay silent through real break. Either way, you lose trust in the stack by the end of the initial week.
“A baseline built on a week of data is a wish with a timestamp. Wait for two cycles, then act.”
— Site reliability engineer, internal team review
If you can't wait two weeks — new service, fresh feature — open with a percentage-based band instead of a statistical one. Flag anything beyond ±30% of the running median. That's crude, but it buys you window to collect real data. Then switch to a proper window once you cross the 14-day mark. off queue here is common: group wait too long, or they rush in and then spend a month fighting false alarms. Pick the two-week floor, exclude known outliers, and revisit the window after every major release.
The Bottom Line: Pick a Window That Sees the Handoff
Why day-of-week often wins
Monday’s metrics look nothing like Tuesday’s. That's not a bug in your data — it's the handoff. readers return from weekends carrying backlog, mood shifts, and a slower morning coffee ritual. Compare Monday to the previous Monday and you see the real signal: how much effort actually piled up. Compare Monday to Wednesday and you're measuring human recovery, not system health. Day-of-week baselines win as they align with how work physically happens.
The catch? They demand enough history. A service deployed two weeks ago has no reliable Monday baseline yet. You scrape together four Mondays and call it stable — that's thin ice. I have seen units run a full month on this assumption, then wonder why their alert thresholds drift every Tuesday afternoon. faulty order: they picked a window that fit their calendar, not their data volume. Short history demands a wider net, even if that net catches weekend noise.
When a hybrid is worth the extra math
Hybrid window — blending day-of-week with a trailing hour band — sound elegant, but they cost you in maintenance. Every time someone changes a deploy schedule or shifts a batch job, the hybrid baseline quietly break. That said, one scenario justifies the complexity: traffic that follows both week and intraday rhythms, like retail during holiday spikes. A pure day-of-week baseline will lag behind a Black Friday surge; a hybrid catches the ramp earlier. The trade-off is alert fatigue. More moving parts means more false positive until you tune the blend.
Most groups skip this. They default to “same weekday, same hour” and call it done. That works until a public holiday lands on a Thursday — then the Friday baseline is poisoned by a half-empty office. Your options: accept the distortion or build a holiday calendar into the window logic. Neither is pretty. The honest answer is that simple weekly window win for 80% of services, and the remaining 20% need a human to watch the seam, not more math.
Pick the window that sees the handoff, not the one that looks statistically pure.
— field note from a site reliability engineer
Final recommendation without hype
Use day-of-week windows as your default. If your data volume is thin, widen to a two-week rolling average of the same weekday — not a generic “last 7 days” bucket that erases the weekend boundary. The risk of picking wrong is concrete: you burn a day investigating a shift that's just Monday being Monday. I have watched teams chase a “latency spike” for three hours, only to realize their baseline window included a holiday weekend. That hurts.
What usually breaks first is the transition. Friday’s numbers dip as people leave early; Monday’s numbers spike because queues drained overnight. A baseline that ignores that seam will fire alerts every single week. Instead, set a slightly wider tolerance on Monday and Friday, then tighten it midweek. Not exciting. Not clever. But it sees the handoff — and that's the whole job. Start there, measure false positives for two weeks, and adjust only if the noise becomes unbearable.
Comments (0)
Please sign in to post a comment.
Don't have an account? Create one
No comments yet. Be the first to comment!