topic Re: Analytics engine time to establish baseline in Cortex XDR Discussions

Analytics engine time to establish baseline

Daniel_Itenberg — Thu, 25 Nov 2021 09:42:03 GMT

Hi all,

I have a question about the analytics engine - how long does it take for it to establish a baseline?

I had it enabled yesterday and it started to give out alerts during the night, in the span of several hours.

seems like a rather short time to establish baselines, even based on data from only the agents installed on the endpoints.

Re: Analytics engine time to establish baseline

bbarmanroy — Fri, 26 Nov 2021 03:49:05 GMT

Hi @Daniel_Itenberg this is highly subjective, based on the host activities. Each detector has its own activation time, based on the data present in CDL. The baseline is also recomputed over time based on newer activities. There might be some FP's in the beginning, but with alerts tuning and recurring baseline computations, the baseline gets normalized ("better") over time.

You can refer to the explanation of various components of detector timelines here.

You can refer to the list of Analytics Alerts here, with the respective timelines.

Re: Analytics engine time to establish baseline

bbarmanroy — Fri, 26 Nov 2021 07:56:52 GMT

I grabbed a screenshot for a tenant. As you can see - beaseline creation can take up to 3 hours, so you were right on the money for baseline creation. I assume EDR was already enabled for 2 weeks or more.