1200km · Detection engineering

Anomaly Detection Atlas

From unusual activity to defensible evidence.

Research, illustrated explanations, statistical models, and collection requirements—connected to your tools, simulations, and detection workspaces.

Start the research path Find an anomaly model

One reference, connected views

An anomaly is an investigation lead, not a maliciousness verdict. Follow the evidence from explanation to collection and testing.

Research and evidence

Read the consolidated foundations, incident analysis, telemetry contracts, and validation boundaries.

Operational families

Fourteen practical views of unusual behavior, plus multi-event correlation.

Activity-to-anomaly models

Compare an entity with an explicit expectation, then identify observable deviation.

Statistical concepts

Explore 118 overlapping statistical concepts without conflating them with operational families.

Telemetry and collection

Browse 175 source categories and verify actual collection requirements.

Rules and visual references

Inspect deterministic concepts alongside the evidence-linked visual library.

Integrated research

Malicious Activity as a Statistical Signal

The revised research now lives within the Atlas as focused chapters and family pages. Its 55 current figures remain beside the explanations, with text equivalents and original source links.

Browse the visual index · Read the evidence and migration scope

The original article remains a publication snapshot; this Atlas is the maintained reference. Existing citations and deep links continue to work.

Malicious Activity as a Statistical Signal: identity, endpoint, network, cloud, application and data telemetry illustrated as blue baselines and red deviations. An anomaly is evidence, not a verdict. — Illustrative cover artwork, not measured telemetry. Malicious activity can resemble ordinary behavior; an anomaly alone does not establish an intrusion.

Start with a worked evidence path

Password spraying · SaaS downloads · Kerberoasting zero-match. Follow hypotheses, fields, queries, fixtures, reported results and limits.

Choose the behavior you need to investigate

These are operational feature families, not 15 mutually exclusive statistical classes. Correlation combines evidence from the other views.

Volumetric Frequency / Rate Temporal Peer-Group Sequence Graph / Relationship Geographic / ASN Identity / Access Rare Process / Service Parent-Child Execution Data Movement Protocol / Application Usage Negative Anomaly (Absence)State-Change Multi-Event Correlation

Continue into the security ecosystem

Use Telemetry Library pages to verify collection, Detection Rules to inspect original rules and models, Attack Simulations for documented authorized-lab candidates, and Attack Tools for tool references and existing guides.

Keep technique and actor context in the Threat Matrix; use AdversaryGraph for evidence-driven investigation. These connections do not imply successful live execution or detector effectiveness.

ATT&CK activity catalog · Search the ecosystem · Existing guides