Detection and Response teams are responsible for keeping the rest of the organization running during an incident. But what happens when the D&R infrastructure itself starts to fail?
In this talk, we will look at how alert floods can overwhelm SIEM, SOAR, enrichment, and case-management pipelines, and why queue saturation can turn a temporary spike in volume into a much longer outage. We will use queueing theory to understand what happens as arrival rates approach processing capacity, why operating near 100% utilization is dangerous, and how backlogs can continue to hurt response long after the original surge is over.
From there, we will look at practical ways to make D&R infrastructure more resilient: reducing unnecessary work, increasing and protecting processing capacity, isolating critical workloads, applying backpressure, shedding lower-value work, and degrading gracefully when dependencies fail. Finally, we will cover how to map your own D&R pipelines, identify weak links, and design them so that the alerts that matter most still get processed when the system is under pressure.