Examples
Examples
Try the starting example
- Log sources: label, minimum expected events per supplied bucket
- API,2 Web,1
- Required time-bucket labels joined by |
- T1|T2
- Received counts: source, bucket, events; or none
- API,T1,3 API,T2,1 Web,T1,0 Unknown,T1,5
- Required source/bucket cells with zero received events
- Web/T1, Web/T2
- Required cells meeting entered minimum (%)
- 25
- Sum positive event shortfalls without cross-cell offsets
- 3
- Unknown source/bucket count records
- Unknown/T1
- Expected minimum events across required matrix
- 6
- Observed events in required cells
- 4
Try another scenario
- Log sources: label, minimum expected events per supplied bucket
- API,2 Web,1
- Required time-bucket labels joined by |
- T1|T2
- Received counts: source, bucket, events; or none
- API,T1,3 API,T2,1 Web,T1,1 Web,T2,1 Unknown,T1,5
- Required source/bucket cells with zero received events
- None
- Required cells meeting entered minimum (%)
- 75
- Sum positive event shortfalls without cross-cell offsets
- 1
- Unknown source/bucket count records
- Unknown/T1
- Expected minimum events across required matrix
- 6
- Observed events in required cells
- 6
Calculation method
Calculation method
Required source/bucket cells with zero received events
Expand every source×bucket; absent count records and explicit zero counts both have zero received events.
Required cells meeting entered minimum (%)
Cells with received≥source minimum/all required matrix cells×100.
Sum positive event shortfalls without cross-cell offsets
Sum max(0,minimum−received) per required cell; excess elsewhere cannot erase gaps.
Unknown source/bucket count records
List supplied records with unknown source or bucket; exclude them from required-cell counts.
Expected minimum events across required matrix
Sum source minimum×required bucket count.
Observed events in required cells
Sum observed counts only in required source/bucket cells.
Symbols and units
- a
- Log sources: label, minimum expected events per supplied bucket
- b
- Required time-bucket labels joined by |
- c
- Received counts: source, bucket, events; or none
Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.
Assumptions & limits
Assumptions & limits
- A supplied minimum-event matrix audit, not proof all security events were recorded or logs were authentic. Bucket labels must refer to comparable windows; expectations are externally supplied and excess events are not evidence of full coverage.
Are these inputs private?
These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.
Further reading
Background reading; this does not imply endorsement or independent review of SumFizz.