baselining
baselining
- Baselining is the assessment of a system or network to establish a "normal use" definition
- Necessary when looking for anomalies and UEBA
- The amount of time it takes to establish a baseline depends on the size and complexity of an organization
- More time reduces the number of false positives, but if you're already compromised or compromised during the baseline, could lead to false negatives.