LogMan.io Baseliner

TeskaLabs LogMan.io Baseliner is a microservice that, based on declarations, detects deviation from a calculated activity baseline.

A baseline is a set of calculated statistical metrics about the activity of a given entity for a given time period.

Examples of entities include: user, device, host server, dataset etc.

Analysis compares the current activity to the learned mean and standard deviation. The deviation is often expressed as sigma (!ARG SIGMA), a Z-score: how many standard deviations the current value is from the mean. See Defining baselines and Detecting user activity anomalies.

Note

If you upgrade baseliner to v24.07-beta or newer, the Baseliner will start the learning phase again. This is required due to the changed approach to database. The following updates from v24.07-beta will not require the learning phase to start again.