Looking for unknown anomalies - what is normal? Time Series analysis & its applications in Security

Hi GeordieIBM ,

Could you share more details about the timestamps within your query especially under TimeSeriesAlerts . The timestamp that you provide for TimeSeriesAlerts will affect the results. If you are specifying in days then you should set same as rule frequency. e.g. currently in Github it is set as > 2d, so you can set rule frequency as 1d.

If you specify it as 8h under TimeSeriesAlerts, then you can set as 8h as rule frequency. Ideally 4h/8h/12h are good to have so that you receive alerts earlier, although for larger data sources such as CommonSecurityLogs, you may want to set as 1d so you are not frequently querying large set of data to avoid performance issues. 

Let me know if you have any specific question further on your use-case.