Glossary

Terms as used on this site. Where usage differs between vendors, the definition here is the one the records assume.

Baseline — a statistical summary of an entity's behaviour over a training window. Everything downstream is a comparison against it.

Base rate — the underlying frequency of the thing being detected. When it is very low, even an accurate detector produces mostly false alerts. This is arithmetic, not a tuning failure.

Cold start — the period when an entity has no usable history, so individual deviation scoring is unavailable.

Concept drift — a change in the relationship between behaviour and risk, as distinct from a change in the data itself.

Contamination rate — the fraction of anomalies an unsupervised model assumes is present in its training data. A guess, and a consequential one.

Deviation score — a measure of how far current activity sits from an entity's baseline. An ordering, not a probability.

Edge — a relationship between two entities, such as user-to-host. Lateral movement is a property of edges rather than of entities.

Enrichment — context attached to an event or alert: role, employment status, asset criticality, data sensitivity.

Entity — anything behaviour is modelled for: a user, host, service account, application or network segment.

Entity resolution — joining the several identifiers belonging to one entity into a single profile. The largest single deployment cost.

Feature — a measurable property of behaviour, counted or categorised per entity per window.

N-gram — a short subsequence of events, used to model ordering.

Peer group — a set of comparable entities used for relative comparison. Meaningless below roughly ten to fifteen members.

Precision — the fraction of alerts that turned out to be something. Measurable, given adjudication capture.

Recall — the fraction of real events that were detected. Not measurable without ground truth.

Sessionisation — grouping events into coherent periods of activity, usually by a gap threshold.

UEBA — user and entity behaviour analytics. Baselining and deviation scoring per entity.