Machine learning: Isolation Forest anomaly model
The platform includes an Isolation Forest anomaly model over ten behaviour features (logins, failed logins, bytes in and out, unique IPs and hosts, processes, connections, file access, hour of day), with a statistical fallback when scikit-learn is not installed.
Status
Partly built
Working today with a narrower scope than the name suggests. The note below says what is covered.
Good to know
Scikit-learn is optional and the model is not yet connected to the live alert path in this release. Live anomaly scoring today uses the statistical baselines below.
See it on your own alerts.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.