Behaviour baselines from your own alert history
User and host baselines built from the tenant's own history: new source IP, unusual hour, volume spike by z-score and novel technique. It says "not evaluated" when there is too little history, rather than inventing a score.
Status
Available
Implemented and covered by automated tests.
Good to know
Statistical, not machine learning. Needs about ten alerts over three days per entity before it scores.
See it on your own alerts.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.