The most common way a domain monitoring programme fails is not missing something. It is finding everything, alerting on all of it, and being switched off in month four.
How it happens
Month 1 Monitoring goes live. Everything is watched,
because narrowing felt like accepting risk.
400 alerts in the first week.
Month 2 Someone builds a filter. 120 a week.
Most are parked domains and renewals.
Month 3 The channel is muted during a busy period.
Nobody unmutes it.
Month 4 An incident. The domain was in the queue,
detected on day one, position 340.
Month 5 A review concludes monitoring was inadequate
and recommends broader coverage.The last step is the one that makes it a cycle. The instinct after a miss is to widen the net, and widening the net is what caused the miss.
The numbers that indicate health
| Metric | Healthy | What an unhealthy value means |
|---|---|---|
| Alerts requiring a human per week | Single figures | Above twenty, they are being skimmed rather than read. |
| Fraction leading to action | A meaningful share | Under a few percent, the rules are matching the wrong things. |
| Time from detection to triage | Hours | Days means the queue is a backlog rather than a workflow. |
| Findings closed with a recorded reason | Nearly all | A queue that only grows is one people stop opening. |
| Repeat findings for the same domain | Near zero | Closure is not being recorded, so the same work repeats. |
What prevents it
- Two tiers, explicitly. A small set of conditions that page someone — new name plus resolving plus MX or a fresh certificate — and everything else in a queue reviewed on a schedule.
- Closure with a reason, always. It is the only thing that stops the same domain consuming an hour every cycle.
- Suppress your own renewals. They are usually the largest single source of volume and carry no information.
- Review the scope quarterly against what was actually acted on, and cut what has never produced anything.
Narrowing scope is a decision, not an oversight
Every exclusion should be written down with its rationale, because after an incident the exclusions are what gets examined. Recorded, it is a decision to revisit with new information. Unrecorded, it is a gap somebody has to account for — and the reflex will be to widen the net again.