Detection Reference
This page lists the values that describe a detection in the Detections and Detection Details pages.
Categories
The category groups detections by the kind of activity. It can be used as a filter on the Detections page.
| Category | Activity | Examples of detections |
|---|---|---|
| C2 | Command and control — an internal host communicating with an external controller, or connecting out in a way its role should not | Confirmed C2 Beacon With Lateral Movement, HTTP C2 Beacon, Serve-Only Role Unexpected External Egress, DNS Tunneling, DGA Suspect |
| UEBA | User and entity behaviour analytics — behaviour that deviates from the host's normal baseline | ML Anomaly |
| Caution | Traffic that matches known attack signatures, such as exploitation attempts and brute force | ThinkPHP RCE Exploitation Attempt, Tilde in URI - potential .php~ source disclosure vulnerability, Tomcat Auth Brute Force attempt |
| Exfiltration | Data leaving the network in unusual ways | Data Exfiltration By Volume, Cloud Exfiltration, Data Transfer Size Limits — Chunked Sub-DLP Exfiltration |
| Discovery | Reconnaissance of the network | Network Port Scan |
Detection methods
The method shows how the detection was produced. It appears as a badge in the detection header and in Grouped › By Alert Type.
| Method | How the detection is produced |
|---|---|
| Signature | Traffic matched a known pattern in the intrusion detection rule set |
| Behaviour | The traffic pattern resembles attacker behaviour, for example beaconing or unusual egress |
| ML | A machine learning model flagged persistent or unusual activity |
| Composite | Several independent indicators agree, for example a signature alert and an ML anomaly on the same host |
Severity, risk, and confidence
| Value | Meaning |
|---|---|
| Severity | High, Medium, or Low — the urgency level of the detection |
| Risk | A score from 0 to 100 calculated from the risk signals. Higher is more urgent. Grouped views show the max risk of the group |
| Confidence | How certain the engine is that the detection is correct, as a percentage |
Tracking status
| Status | Meaning |
|---|---|
| Open | New, not yet reviewed |
| Acknowledged | Seen by an analyst and accepted for review |
| In Progress | Investigation or response actions are under way |
| Closed | Handling is complete |
The status, assignee, and notes are set in the Detection Tracking panel. See Detection Details.
Risk signals
Risk signals are the engine measurements behind the risk score. On the detection page, elevated signals are highlighted.
| Signal | What it measures |
|---|---|
| IDS Signature | Whether traffic matched an intrusion detection signature, and the rule level |
| ML Anomaly | How anomalous the activity is for the host, or within baseline |
| Temporal Threat | Suspicious timing, for example off-hours activity |
| Connection Rate | Connections per minute, with rate spike when unusually high |
| Beaconing | Regular, repeated connections to the same destination — confirmed when detected, with the interval variation (interval CV) |
| Fan-out / Lateral | How many internal peers the host contacts compared with normal, with lateral movement detected when elevated |
| Encrypted Traffic Anomaly | Unusual characteristics of encrypted (TLS) traffic |
| Peer Deviation | How unusual the peer is for this host |
| NXDOMAIN Ratio | Share of DNS lookups for non-existent domains (shown when relevant) |
Asset attributes
Detections show the role and criticality of the internal asset.
| Attribute | Examples |
|---|---|
| Role | HTTP Server, Workstation, Camera, Mobile, DNS Server, Gateway, Database, Virtual Machine |
| Criticality | High, Medium, Low |
| Tier | Internal, Critical |
Roles are detected automatically from traffic. See Assets.