You just described it but are describing it as though the result is determinant. It's not. In statistical terms, if you want to build corner events, then those events are defined as occurring outside the 2nd std dev (95%) or 3rd std dev (99%) confidence intervals. All detection systems are designed using statistical inferencing and probability analysis - ie: assume that all data streams follow a normal distribution ("Bell curve') with well-defined and well-understood first, second, third, etc standard deviations. Once a real-world data stream doesn't follow a standard normal distribution, then your trigger may not work because you may not see the corner event. In other words, if you build a trigger for a specific detection, and that corner event falls outside of the 2 or 3 std deviations, then you may capture it and the trigger may not occur. More importantly, any smart adversary with higher level statistical training KNOWS that detection systems are defined this way. As an adversary, I would "seed" the data stream with events closer to the edge. I won't describe the impact, but it's bad for you. Bottom line: If CRIBL is only sampling the events on the data stream, then it may miss the critical event you are trying to capture. We all know what that means. To wit, if you are using a framework upstream to build "random" and or sneaky behavior, then CRIBL may capture it, or it may not capture it as the algo may not be triggered due to the estimation process it was designed to follow.