Skip to content

Glossary: Attacks and Indicators

baseline

What normal activity looks like, such as backups always running at 1 a.m. You compare an indicator against the baseline to decide whether it is really unusual.

Where the book teaches it

Related terms

false positivebehavioral indicator