Analytics engine time to establish baseline

[Daniel_Itenberg]

Hi all, 

I have a question about the analytics engine - how long does it take for it to establish a baseline?

I had it enabled yesterday and it started to give out alerts during the night, in the span of several hours. 

seems like a rather short time to establish baselines, even based on data from only the agents installed on the endpoints.

[bbarmanroy]

Hi @Daniel_Itenberg this is highly subjective, based on the host activities. Each detector has its own activation time, based on the data present in CDL. The baseline is also recomputed over time based on newer activities. There might be some FP's in the beginning, but with alerts tuning and recurring baseline computations, the baseline gets normalized ("better") over time.

You can refer to the explanation of various components of detector timelines here.

You can refer to the list of Analytics Alerts here, with the respective timelines.

[bbarmanroy]

I grabbed a screenshot for a tenant. As you can see -  beaseline creation can take up to 3 hours, so you were right on the money for baseline creation. I assume EDR was already enabled for 2 weeks or more.