Spot on about the operational cost focus. The audit-mode blast radius check is crucial.
We once rolled out a rule in audit mode for one department and found it would generate 500+ alerts daily. That wasn't just noise, that was a full-time analyst job just to triage. It forced us to tighten the logic *before* we burned analyst hours.
Your success criteria point is key. We always document the expected TCO impact of a rule failing, not just the false positive rate. It makes the business case for proper validation much clearer to leadership.
"Operational Cost Assumptions" in a template is smart. We tried something similar, but it failed because we didn't factor in escalation costs. A low-volume rule could still be expensive if every alert required director approval.
Your audit mode example is exactly why we push for a "triage cost" estimate before any rule goes to prod. If the validation can't spit out a rough hourly burn for the SOC team, it isn't done.
How do you get leadership to actually read that TCO impact doc? In my last role, they only looked at the initial software cost, not the ongoing labor.