Baselines and anomaly detection
The sensor builds a statistical baseline of network behaviour for each resource (identified by MAC address). It tracks the following metrics over time:
- Packets per second (total and unicast)
- Bytes per second
- The share of broadcast and multicast traffic relative to total traffic
- The number of unique destination IPs, destination ports, and protocols a resource communicates with
For each metric, the sensor computes running statistics: the count of observations, the mean, and the standard deviation. It also tracks the set of external destination IPs and protocols a resource has ever communicated with.
Baseline reliability
The sensor requires a minimum number of samples before it considers a baseline reliable. By default, this is 288 samples. With the default observation interval, this takes roughly two days of continuous monitoring. Until the minimum is reached, the baseline is not used for anomaly detection.
Surfacing deviations
Once a baseline is established, the sensor compares each new observation against the learned statistics. A significant deviation (for example, a device that normally sends 10 packets per second suddenly sending 1000, or a PLC that has never communicated with an external IP now doing so) triggers the relevant detection rules. These deviations appear as alerts in the Threat Detection view.
The baseline continues to learn and adapt over time. It is not frozen after the initial training period.