Baseline means understanding normal variation
Knowing what normal looks like means knowing how much it moves, not just its average.
Traffic varies by hour, day, month end and holiday. A baseline that ignores that variation flags every Monday morning. Establishing normal is genuinely difficult and is the prerequisite for anomaly detection actually working, which is why so many anomaly products are turned down until they detect nothing.
More on Threat hunting
- Hunting starts with a question, not a dashboardBring a question
- Absence of evidence depends on coverageOnly the lit part was searched
- Hunts can become future detectionsLeave a bell on the path
- Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
- Entity context turns events into investigationsThread the beads
- Hunt scope should be explicitPeg out the ground first