Lesson 3.7: Thresholds and baselines
Some attacks aren't a single suspicious event but too many ordinary ones: failed logons, DNS queries, downloaded megabytes. Detecting them means counting within a time window and comparing with a threshold, and the threshold should come from what's normal for your organisation (the baseline), not from a guess. In the lab you compare a normal day's failed logons with last night's, find a password spray that a per-user rule would miss, choose a window and a threshold, and prove the rule fires on the attack and stays quiet on a normal day.
17 min
You will learn to
- Explain threshold-based detection
- Measure a baseline from normal data
- Count per source and per window
- Tell brute force from password spraying
- Test a threshold against normal and attack data
Key terms
- Threshold
- The count above which a rule fires.
- Time window
- The period over which events are counted.
- Baseline
- What normal activity looks like for a system, user or network, measured over time.
- Password spraying
- Trying a few common passwords against many accounts to avoid lockouts.
- Brute force
- Trying many passwords against one account.
← Protecting sessions and cookies · All lessons · Password policy and breached passwords →