set category fields in default anomaly detectors to give a better breakdown of contributors

idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

https://idaholab.github.io/Malcolm/

Other

353 stars 58 forks source link

set category fields in default anomaly detectors to give a better breakdown of contributors #464

Closed mmguero closed 5 months ago

mmguero commented 5 months ago

(Optional) Set category fields for high cardinality

You can categorize anomalies based on a keyword or IP field type.

The category field categorizes or slices the source time series with a dimension like IP addresses, product IDs, country codes, and so on. This helps to see a granular view of anomalies within each entity of the category field to isolate and debug issues.

mmguero commented 5 months ago