LogMan.io Baseliner

TeskaLabs LogMan.io Baseliner is a microservice that, based on declarations, detects deviation from a calculated activity baseline.

A baseline is a set of calculated statistical metrics about the activity of a given entity for a given time period.

Examples of entities include: user, device, host server, dataset etc.

Analysis compares the current activity to the learned baseline using one statistical model (baseline.model: normal, poisson, or negbin). The primary anomaly score is always !ARG SIGMA on a shared normal-equivalent rarity scale. For raw hourly event counts, prefer model: negbin (Negative Binomial with automatic Poisson fallback). See Defining baselines and Detecting user activity anomalies.

Note

If you upgrade baseliner to v24.07-beta or newer, the Baseliner will start the learning phase again. This is required due to the changed approach to database. The following updates from v24.07-beta will not require the learning phase to start again.