Overview
Baselines — knowing what "normal" looks like — are what make anomaly detection possible. This lesson covers baselines in monitoring.
Learning objectives
- Define a baseline in security monitoring.
- Explain why baselines enable anomaly detection.
- Connect baselines to distinguishing normal from suspicious.
Core concept
A baseline is an established understanding of normal activity for an environment — typical traffic patterns, usual login behavior, standard process activity, normal resource usage, and so on. Baselines are essential because anomaly detection works by spotting deviations from normal — and without knowing what normal is, you can't recognize the abnormal. Building on the anomaly-recognition principle (from the networking and Linux paths), baselines are the reference against which monitoring judges whether observed activity is routine or suspicious. Much of security monitoring depends on good baselines.
How it works
The SOC establishes baselines by observing and characterizing normal activity over time — what's typical for users, systems, network traffic, and processes. Monitoring then compares observed activity against these baselines: activity consistent with the baseline is routine; deviations (unusual logins, atypical traffic, abnormal process behavior) stand out as potential threats warranting investigation. Baselines must account for legitimate variation (normal changes by time of day, role, etc.) to avoid flagging benign fluctuations. Good baselines make anomalies visible; poor or absent baselines mean either missing real anomalies (no reference) or drowning in false alerts (flagging normal variation). Baselines are the foundation of anomaly-based detection.
Practical example
A SOC has a baseline of normal authentication behavior — typical login times, locations, and devices for users. When monitoring observes a login that deviates sharply from this baseline (say, an unusual location and device at an atypical time for that account), it stands out as a potential anomaly worth investigating (possible account compromise). Without the baseline, that login would look like just another event; with it, the deviation is visible. The baseline made anomaly detection possible — distinguishing the suspicious login from routine activity.
Cybersecurity relevance
Baselines are foundational to anomaly-based detection, a core monitoring approach: recognizing threats by their deviation from normal requires knowing normal, so baselines are the essential reference. They apply the anomaly-recognition/baseline principle (from networking and Linux) at SOC scale. Good baselines make real anomalies visible while accounting for legitimate variation (avoiding false alerts on benign fluctuation); poor/absent baselines cause missed detections or alert floods. Baselines underpin much of security monitoring and detection (authentication anomalies, network/endpoint anomalies — covered later). Establishing and maintaining accurate baselines is a key monitoring discipline.
Common mistakes
- No baseline, so anomalies can't be recognized (no reference for "normal").
- Baselines that ignore legitimate variation, flagging benign fluctuations as anomalies.
- Stale baselines that don't reflect how normal has changed.
Key takeaways
- A baseline is an established understanding of normal activity (traffic, logins, processes, resource usage) for an environment.
- Anomaly detection works by spotting deviations from normal, so baselines are the essential reference — without them, the abnormal can't be recognized.
- Good baselines (accounting for legitimate variation) make real anomalies visible; poor/absent ones cause missed detections or false-alert floods — foundational to monitoring.
Check your understanding
- Why are baselines essential for anomaly detection?
- Why must baselines account for legitimate variation, and what happens if they don't?