Behavioral baselines and anomaly detection

When Static Rules Fail

Static SIEM rules detect threshold violations and specific patterns. They miss threats that operate within "normal" thresholds but represent abnormal behavior. Example: an attacker performing a slow, careful reconnaissance of the NF inventory — 50 NRF queries per hour from a single source, well within normal volume. Static threshold rules ("alert on >1000 NRF queries per hour") miss this. The behavioral baseline approach: track per-source query rates over time; calculate normal ranges; alert when a source's rate is significantly above its own baseline, regardless of absolute number. This…