What a behavior change means
Behavior analytics compares supported current activity with an entity-specific baseline or recent pattern. It helps identify meaningful change that may deserve review. The result should show the entity, changed behavior, baseline period, evidence time, confidence, and coverage.
A change is not automatically malicious. Expected operations, new roles, migrations, seasonal work, and improved data coverage can all change a baseline.
Review an anomaly
- Confirm the entity identity, customer scope, source, and event time.
- Compare the current behavior with the stated baseline and learning period.
- Review confidence, freshness, missing evidence, model history, and recent source changes.
- Look for related alerts, threat matches, asset drift, exposure change, and known business activity.
- Record whether the change is expected, suspicious, unresolved, or caused by coverage change.
Check unusual behavior before drawing a conclusion
Behavior context can strengthen prioritization or a hunt hypothesis when it is supported by current evidence. It does not replace the source event, create a final incident conclusion, or authorize response.