search

microsoft / msticpy

Microsoft Threat Intelligence Security Tools
Other
1.78k stars 321 forks source link

Issue with timeseries analysis in the case of score > score_threshold & seasonal == 0 #615

Open pensivepaddle opened 1 year ago

pensivepaddle commented 1 year ago

https://github.com/microsoft/msticpy/blob/main/msticpy/analysis/timeseries.py#L293-L299

Missing logic for time series anomaly detection for the case of (result["score"] > score_threshold) & (result["seasonal"] == 0)

whereas >0 and <0 are covered.

It leads to an error in the later typecasting to int64.

Not sure if change from lt/gt to le/ge, or a different approach is most appropriate.

ianhelle commented 1 year ago

@ashwin-patil - not sure what the correct thing to do here is. Seems like setting anomalies should default to 0 before the two statements that set to +/- 1. Since there are 2 separate values being used here to determine anomaly marking, there are potential cases where score could be >, < and == score_threshold, also where seasonal could be >, < and == 0.