{ "schema_version": 1, "consolidated_at": "2026-09-27", "publication_snapshot": "https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/", "source": { "imported": "2026-09-27", "source_repository": "https://github.com/anpa1200/medium-blog-navigation", "source_commit": "a94750828ed75dbce4c1e9a9f4ea1994fa785943", "files": [ { "source": "docs/articles/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12.md", "dest": "research-source.md", "sha256": "1d1c6bc73fed27406b271920ffaaa1dd536a70d2b078cd838c78adf27c3261cd" }, { "source": "static/research/anomaly-visuals/manifest.json", "dest": "visuals.json", "sha256": "9524d3bd9f87b979a6549d7672cdc5d932b881798b25780ab5de21e2295afbe1" }, { "source": "static/research/anomaly-visuals/uploaded-cover-provenance.json", "dest": "cover.json", "sha256": "2723a535adf96111bf75b2a997abbb2e7379ec1e6eae0f9fa01b3c8ecc3c832f" }, { "source": "static/research/anomaly-incidents.json", "dest": "incidents.json", "sha256": "406ec9eb2bb24e730860774c11398376277369f31a4c8c425ca695ea86783cb8" } ] }, "evidence_boundary": "Source preservation and integration review; not a fresh full incident audit or detector execution.", "counts": { "operational_families": 14, "correlation_patterns": 1, "figures": 55, "models": 54 }, "families": [ { "id": "volumetric", "title": "Volumetric", "url": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "tag": "anomaly-volumetric", "models": [ "bulk-data-access", "large-outbound-transfer", "ransomware-encryption", "service-disruption" ], "telemetry": [ "DC0078", "DC0025", "DC0055" ], "techniques": [ "T1078.004", "T1499" ] }, { "id": "frequency-rate", "title": "Frequency / Rate", "url": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "tag": "anomaly-frequency-rate", "models": [ "password-guessing", "password-spraying", "mfa-fatigue", "external-service-scanning", "internal-service-scanning" ], "telemetry": [ "DC0002", "DC0082", "DC0084" ], "techniques": [ "T1499", "T1110.003" ] }, { "id": "temporal", "title": "Temporal", "url": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "tag": "anomaly-temporal", "models": [ "scheduled-execution", "periodic-c2", "external-remote-session", "low-and-slow-exfiltration" ], "telemetry": [ "DC0001", "DC0032", "DC0078" ], "techniques": [ "T1071.004", "T1053.005" ] }, { "id": "peer-group", "title": "Peer-Group", "url": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "tag": "anomaly-peer-group", "models": [ "privilege-elevation", "cloud-enumeration", "privileged-container", "resource-hijacking", "secret-retrieval" ], "telemetry": [ "DC0013", "DC0110", "DC0038" ], "techniques": [ "T1496" ] }, { "id": "sequence", "title": "Sequence", "url": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "tag": "anomaly-sequence", "models": [ "phishing-delivery", "phishing-execution-sequence", "data-staging", "lateral-tool-transfer", "serverless-execution", "container-exec" ], "telemetry": [ "DC0032", "DC0067", "DC0038" ], "techniques": [ "T1098.005", "T1087.002" ] }, { "id": "graph-relationship", "title": "Graph / Relationship", "url": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "tag": "anomaly-graph-relationship", "models": [ "account-manipulation", "remote-service-lateral-movement", "process-injection", "account-enumeration" ], "telemetry": [ "DC0066", "DC0067", "DC0082" ], "techniques": [ "T1098" ] }, { "id": "geographic-asn", "title": "Geographic / ASN", "url": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "tag": "anomaly-geographic-asn", "models": [ "valid-account-abuse", "external-remote-session" ], "telemetry": [ "DC0002", "DC0088", "DC0078" ], "techniques": [ "T1078.004", "T1110.003" ] }, { "id": "identity-access", "title": "Identity / Access", "url": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "tag": "anomaly-identity-access", "models": [ "valid-account-abuse", "account-creation", "account-manipulation", "mail-forwarding-rule", "secret-retrieval", "password-spraying" ], "telemetry": [ "DC0002", "DC0010", "DC0007" ], "techniques": [ "T1098.005", "T1550.001" ] }, { "id": "rare-process-service", "title": "Rare Process / Service", "url": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "tag": "anomaly-rare-process-service", "models": [ "command-interpreter-execution", "service-persistence", "masquerading", "credential-dumping" ], "telemetry": [ "DC0032", "DC0060", "DC0034" ], "techniques": [ "T1087.002", "T1040" ] }, { "id": "parent-child", "title": "Parent-Child Execution", "url": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "tag": "anomaly-parent-child", "models": [ "powershell-abuse", "trusted-binary-proxy-execution", "public-app-exploitation", "phishing-execution-sequence" ], "telemetry": [ "DC0032", "DC0029" ], "techniques": [ "T1059.001", "T1059.003" ] }, { "id": "data-movement", "title": "Data Movement", "url": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "tag": "anomaly-data-movement", "models": [ "bulk-data-access", "mailbox-collection", "data-staging", "large-outbound-transfer", "web-service-exfiltration", "low-and-slow-exfiltration" ], "telemetry": [ "DC0025", "DC0055", "DC0078" ], "techniques": [ "T1078.004", "T1567.002" ] }, { "id": "protocol-application", "title": "Protocol / Application Usage", "url": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "tag": "anomaly-protocol-application", "models": [ "dns-c2", "dns-enumeration", "periodic-c2", "encrypted-channel", "web-service-c2", "public-web-enumeration" ], "telemetry": [ "DC0085", "DC0078", "DC0038" ], "techniques": [ "T1071.004" ] }, { "id": "negative-absence", "title": "Negative Anomaly (Absence)", "url": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "tag": "anomaly-negative-absence", "models": [ "tool-disablement", "indicator-removal", "recovery-impairment" ], "telemetry": [ "DC0018", "DC0090", "DC0069" ], "techniques": [ "T1685.002", "T1685" ] }, { "id": "state-change", "title": "State-Change", "url": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "tag": "anomaly-state-change", "models": [ "autostart-change", "service-persistence", "firewall-impairment", "account-creation", "account-manipulation", "mail-forwarding-rule", "supply-chain-installation", "data-destruction" ], "telemetry": [ "DC0066", "DC0010", "DC0069", "DC0063" ], "techniques": [ "T1098", "T1496", "T1505.003" ] }, { "id": "multi-event-correlation", "title": "Multi-Event Correlation", "url": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "tag": "anomaly-multi-event-correlation", "models": [ "phishing-execution-sequence", "process-injection", "lateral-tool-transfer", "kerberoasting", "obfuscated-content" ], "telemetry": [ "DC0032", "DC0067", "DC0038" ], "techniques": [ "T1098.005", "T1567.002", "T1087.002" ] } ], "pages": [ { "id": "foundations", "title": "Foundations: from unusual activity to evidence", "url": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "figures": [ "statistical-forms", "definition-contextual", "definition-collective", "definition-correlation", "base-rate" ], "techniques": [], "tags": [] }, { "id": "families/volumetric", "title": "Volumetric", "url": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "figures": [ "family-volumetric" ], "techniques": [ "T1078.004", "T1499" ], "tags": [ "anomaly-volumetric" ] }, { "id": "families/frequency-rate", "title": "Frequency / Rate", "url": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "figures": [ "family-frequency-rate" ], "techniques": [ "T1499", "T1110.003" ], "tags": [ "anomaly-frequency-rate" ] }, { "id": "families/temporal", "title": "Temporal", "url": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "figures": [ "family-temporal" ], "techniques": [ "T1071.004", "T1053.005" ], "tags": [ "anomaly-temporal" ] }, { "id": "families/peer-group", "title": "Peer-Group", "url": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "figures": [ "family-peer-group" ], "techniques": [ "T1496" ], "tags": [ "anomaly-peer-group" ] }, { "id": "families/sequence", "title": "Sequence", "url": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "figures": [ "family-sequence" ], "techniques": [ "T1098.005", "T1087.002" ], "tags": [ "anomaly-sequence" ] }, { "id": "families/graph-relationship", "title": "Graph / Relationship", "url": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "figures": [ "family-graph-relationship" ], "techniques": [ "T1098" ], "tags": [ "anomaly-graph-relationship" ] }, { "id": "families/geographic-asn", "title": "Geographic / ASN", "url": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "figures": [ "family-geographic-asn" ], "techniques": [ "T1078.004", "T1110.003" ], "tags": [ "anomaly-geographic-asn" ] }, { "id": "families/identity-access", "title": "Identity / Access", "url": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "figures": [ "family-identity-access" ], "techniques": [ "T1098.005", "T1550.001" ], "tags": [ "anomaly-identity-access" ] }, { "id": "families/rare-process-service", "title": "Rare Process / Service", "url": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "figures": [ "family-rare-process-service" ], "techniques": [ "T1087.002", "T1040" ], "tags": [ "anomaly-rare-process-service" ] }, { "id": "families/parent-child", "title": "Parent-Child Execution", "url": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "figures": [ "family-parent-child" ], "techniques": [ "T1059.001", "T1059.003" ], "tags": [ "anomaly-parent-child" ] }, { "id": "families/data-movement", "title": "Data Movement", "url": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "figures": [ "family-data-movement" ], "techniques": [ "T1078.004", "T1567.002" ], "tags": [ "anomaly-data-movement" ] }, { "id": "families/protocol-application", "title": "Protocol / Application Usage", "url": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "figures": [ "family-protocol-application" ], "techniques": [ "T1071.004" ], "tags": [ "anomaly-protocol-application" ] }, { "id": "families/negative-absence", "title": "Negative Anomaly (Absence)", "url": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "figures": [ "family-negative-absence" ], "techniques": [ "T1685.002", "T1685" ], "tags": [ "anomaly-negative-absence" ] }, { "id": "families/state-change", "title": "State-Change", "url": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "figures": [ "family-state-change" ], "techniques": [ "T1098", "T1496", "T1505.003" ], "tags": [ "anomaly-state-change" ] }, { "id": "families/multi-event-correlation", "title": "Multi-Event Correlation", "url": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "figures": [ "family-multi-event-correlation" ], "techniques": [ "T1098.005", "T1567.002", "T1087.002" ], "tags": [ "anomaly-multi-event-correlation" ] }, { "id": "incidents", "title": "Incident register and evidence boundaries", "url": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "figures": [ "incident-register" ], "techniques": [ "T1685", "T1685.002" ], "tags": [] }, { "id": "attack-mapping", "title": "ATT&CK mapping and version boundaries", "url": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "figures": [ "attack-mapping" ], "techniques": [], "tags": [] }, { "id": "cases", "title": "Documented campaigns and detection interpretations", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figures": [ "case-sunburst", "case-exchange", "case-conti", "case-oilrig", "case-moveit", "case-midnight", "case-unc3944", "case-storm", "case-volt", "case-apt41", "case-impacket", "case-3cx" ], "techniques": [], "tags": [] }, { "id": "telemetry", "title": "Telemetry contracts and collection requirements", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figures": [ "telemetry-contract", "source-windows", "source-sysmon", "source-edr", "source-ndr", "source-iam", "source-cloud", "dns-entropy", "source-saas", "source-prioritization" ], "techniques": [], "tags": [] }, { "id": "credentials", "title": "Credential-access detection engineering", "url": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "figures": [ "credential-kerberoast", "credential-dcsync", "credential-pth", "credential-lsass" ], "techniques": [ "T1558.003", "T1550.002" ], "tags": [] }, { "id": "visibility", "title": "Visibility limits and competing explanations", "url": "https://1200km.com/anomaly-detection-atlas/research/visibility/", "figures": [ "visibility-limits" ], "techniques": [], "tags": [] }, { "id": "queries", "title": "Detection patterns and maintained KQL examples", "url": "https://1200km.com/anomaly-detection-atlas/research/queries/", "figures": [ "analytic-contract", "validation-levels" ], "techniques": [], "tags": [] }, { "id": "validation", "title": "Validation, baselines, and operational decisions", "url": "https://1200km.com/anomaly-detection-atlas/research/validation/", "figures": [ "operational-workflow", "study-splits", "study-results" ], "techniques": [], "tags": [] }, { "id": "references", "title": "Sources, provenance, and further research", "url": "https://1200km.com/anomaly-detection-atlas/research/references/", "figures": [], "techniques": [], "tags": [] } ], "models": [ { "id": "external-service-scanning", "title": "Repeated probing of public services", "technique": "T1595" }, { "id": "public-web-enumeration", "title": "Enumeration of public web paths and APIs", "technique": "T1595.003" }, { "id": "dns-enumeration", "title": "DNS enumeration or zone-transfer attempts", "technique": "T1590" }, { "id": "phishing-delivery", "title": "Malicious attachment, link, or message delivery", "technique": "T1566" }, { "id": "phishing-execution-sequence", "title": "User opens delivered content followed by execution", "technique": "T1566" }, { "id": "public-app-exploitation", "title": "Public-facing application exploitation", "technique": "T1190" }, { "id": "valid-account-abuse", "title": "Valid credentials used from an unexpected context", "technique": "T1078" }, { "id": "external-remote-session", "title": "External remote-service session", "technique": "T1133" }, { "id": "supply-chain-installation", "title": "Compromised software or update installation", "technique": "T1195" }, { "id": "command-interpreter-execution", "title": "Command or scripting interpreter execution", "technique": "T1059" }, { "id": "powershell-abuse", "title": "PowerShell script, encoded content, or remote command execution", "technique": "T1059.001" }, { "id": "trusted-binary-proxy-execution", "title": "Trusted system binary launches unexpected content", "technique": "T1218" }, { "id": "scheduled-execution", "title": "Scheduled job, service, or automation executes payload", "technique": "T1053" }, { "id": "container-exec", "title": "Container administration interface executes command", "technique": "T1609" }, { "id": "serverless-execution", "title": "Unexpected serverless or cloud-workload invocation", "technique": "T1648" }, { "id": "account-creation", "title": "New local, domain, cloud, or service account", "technique": "T1136" }, { "id": "account-manipulation", "title": "Credential, group, role, or account-property modification", "technique": "T1098" }, { "id": "autostart-change", "title": "Startup or logon configuration changed to launch code", "technique": "T1547" }, { "id": "service-persistence", "title": "New or modified system service", "technique": "T1543" }, { "id": "mail-forwarding-rule", "title": "Email forwarding rule created", "technique": "T1114.003" }, { "id": "privileged-container", "title": "Privileged or long-running container workload deployed", "technique": "T1610" }, { "id": "privilege-elevation", "title": "Process or account invokes elevation mechanism", "technique": "T1548" }, { "id": "masquerading", "title": "Object renamed to resemble trusted object", "technique": "T1036" }, { "id": "obfuscated-content", "title": "Encoded, packed, or obfuscated content", "technique": "T1027" }, { "id": "process-injection", "title": "Process injection or in-memory execution", "technique": "T1055" }, { "id": "indicator-removal", "title": "File timestamps, metadata, logs, or indicators modified", "technique": "T1070" }, { "id": "tool-disablement", "title": "Security tool, sensor, or logging disabled", "technique": "T1562.001" }, { "id": "firewall-impairment", "title": "Firewall policy disabled or weakened", "technique": "T1562.004" }, { "id": "password-guessing", "title": "Repeated password guessing against an account", "technique": "T1110" }, { "id": "password-spraying", "title": "Low-volume failures distributed across many accounts", "technique": "T1110.003" }, { "id": "mfa-fatigue", "title": "Repeated MFA prompts and denials", "technique": "T1621" }, { "id": "credential-dumping", "title": "Protected credential memory or stores accessed", "technique": "T1003" }, { "id": "kerberoasting", "title": "Unusual service-ticket requests", "technique": "T1558.003" }, { "id": "secret-retrieval", "title": "Cloud secrets, keys, or tokens retrieved", "technique": "T1552" }, { "id": "account-enumeration", "title": "Accounts, groups, roles, or permissions enumerated", "technique": "T1087" }, { "id": "internal-service-scanning", "title": "Internal network services or systems scanned", "technique": "T1046" }, { "id": "cloud-enumeration", "title": "Cloud resources or configurations enumerated", "technique": "T1580" }, { "id": "remote-service-lateral-movement", "title": "Remote administrative service used between systems", "technique": "T1021" }, { "id": "lateral-tool-transfer", "title": "Tool or payload transferred internally", "technique": "T1570" }, { "id": "bulk-data-access", "title": "Files, records, messages, or objects accessed in bulk", "technique": "T1119" }, { "id": "mailbox-collection", "title": "Email content collected", "technique": "T1114" }, { "id": "data-staging", "title": "Data staged, compressed, or archived", "technique": "T1074" }, { "id": "large-outbound-transfer", "title": "Large outbound transfer", "technique": "T1041" }, { "id": "web-service-exfiltration", "title": "Data uploaded to cloud or web service", "technique": "T1567" }, { "id": "low-and-slow-exfiltration", "title": "Transfers deliberately limited to evade controls", "technique": "T1030" }, { "id": "periodic-c2", "title": "Endpoint communicates periodically with external destination", "technique": "T1071" }, { "id": "dns-c2", "title": "DNS carries command, control, or encoded data", "technique": "T1071.004" }, { "id": "encrypted-channel", "title": "Encrypted or obfuscated network channel", "technique": "T1573" }, { "id": "web-service-c2", "title": "Web or collaboration service used as control channel", "technique": "T1102" }, { "id": "data-destruction", "title": "Files, records, or resources deleted or destroyed", "technique": "T1485" }, { "id": "ransomware-encryption", "title": "Files encrypted for impact", "technique": "T1486" }, { "id": "service-disruption", "title": "Service or system availability disrupted", "technique": "T1499" }, { "id": "recovery-impairment", "title": "Backup, snapshot, or recovery capability impaired", "technique": "T1490" }, { "id": "resource-hijacking", "title": "Unauthorized computation or resource abuse", "technique": "T1496" } ], "figures": [ { "id": "research-map", "url": "https://1200km.com/anomaly-detection-atlas/research/" }, { "id": "statistical-forms", "url": "https://1200km.com/anomaly-detection-atlas/research/foundations/" }, { "id": "definition-contextual", "url": "https://1200km.com/anomaly-detection-atlas/research/foundations/" }, { "id": "definition-collective", "url": "https://1200km.com/anomaly-detection-atlas/research/foundations/" }, { "id": "definition-correlation", "url": "https://1200km.com/anomaly-detection-atlas/research/foundations/" }, { "id": "base-rate", "url": "https://1200km.com/anomaly-detection-atlas/research/foundations/" }, { "id": "family-volumetric", "url": "https://1200km.com/anomaly-detection-atlas/families/volumetric/" }, { "id": "family-frequency-rate", "url": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/" }, { "id": "family-temporal", "url": "https://1200km.com/anomaly-detection-atlas/families/temporal/" }, { "id": "family-peer-group", "url": "https://1200km.com/anomaly-detection-atlas/families/peer-group/" }, { "id": "family-sequence", "url": "https://1200km.com/anomaly-detection-atlas/families/sequence/" }, { "id": "family-graph-relationship", "url": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/" }, { "id": "family-geographic-asn", "url": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/" }, { "id": "family-identity-access", "url": "https://1200km.com/anomaly-detection-atlas/families/identity-access/" }, { "id": "family-rare-process-service", "url": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/" }, { "id": "family-parent-child", "url": "https://1200km.com/anomaly-detection-atlas/families/parent-child/" }, { "id": "family-data-movement", "url": "https://1200km.com/anomaly-detection-atlas/families/data-movement/" }, { "id": "family-protocol-application", "url": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/" }, { "id": "family-negative-absence", "url": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/" }, { "id": "family-state-change", "url": "https://1200km.com/anomaly-detection-atlas/families/state-change/" }, { "id": "family-multi-event-correlation", "url": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/" }, { "id": "incident-register", "url": "https://1200km.com/anomaly-detection-atlas/research/incidents/" }, { "id": "attack-mapping", "url": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/" }, { "id": "case-sunburst", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-exchange", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-conti", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-oilrig", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-moveit", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-midnight", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-unc3944", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-storm", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-volt", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-apt41", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-impacket", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "case-3cx", "url": "https://1200km.com/anomaly-detection-atlas/research/cases/" }, { "id": "telemetry-contract", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-windows", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-sysmon", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-edr", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-ndr", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-iam", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-cloud", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "dns-entropy", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-saas", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "source-prioritization", "url": "https://1200km.com/anomaly-detection-atlas/research/telemetry/" }, { "id": "credential-kerberoast", "url": "https://1200km.com/anomaly-detection-atlas/research/credentials/" }, { "id": "credential-dcsync", "url": "https://1200km.com/anomaly-detection-atlas/research/credentials/" }, { "id": "credential-pth", "url": "https://1200km.com/anomaly-detection-atlas/research/credentials/" }, { "id": "credential-lsass", "url": "https://1200km.com/anomaly-detection-atlas/research/credentials/" }, { "id": "visibility-limits", "url": "https://1200km.com/anomaly-detection-atlas/research/visibility/" }, { "id": "analytic-contract", "url": "https://1200km.com/anomaly-detection-atlas/research/queries/" }, { "id": "validation-levels", "url": "https://1200km.com/anomaly-detection-atlas/research/queries/" }, { "id": "operational-workflow", "url": "https://1200km.com/anomaly-detection-atlas/research/validation/" }, { "id": "study-splits", "url": "https://1200km.com/anomaly-detection-atlas/research/validation/" }, { "id": "study-results", "url": "https://1200km.com/anomaly-detection-atlas/research/validation/" } ], "anchors": { "1-the-hypothesis--scope-and-definitions": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "11-definitions": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "anomaly-form-point": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "anomaly-form-contextual": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "anomaly-form-collective": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "12-the-central-tension": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "statistical-forms": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "definition-contextual": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "definition-collective": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "definition-correlation": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "base-rate": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "figure-statistical-forms": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "figure-definition-contextual": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "figure-definition-collective": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "figure-definition-correlation": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "figure-base-rate": "https://1200km.com/anomaly-detection-atlas/research/foundations/", "anomaly-volumetric": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "case-volumetric-unc5537-snowflake-2024": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "case-volumetric-rapid-reset-2023": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "family-volumetric": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "figure-family-volumetric": "https://1200km.com/anomaly-detection-atlas/families/volumetric/", "anomaly-frequency-rate": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "case-frequency-rate-rapid-reset-2023": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "case-frequency-rate-midnight-blizzard-2024": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "family-frequency-rate": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "figure-family-frequency-rate": "https://1200km.com/anomaly-detection-atlas/families/frequency-rate/", "anomaly-temporal": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "case-temporal-sunburst-2020": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "case-temporal-industroyer2-2022": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "family-temporal": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "figure-family-temporal": "https://1200km.com/anomaly-detection-atlas/families/temporal/", "anomaly-peer-group": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "case-peer-group-twitter-insider": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "case-peer-group-storm1283-2023": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "family-peer-group": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "figure-family-peer-group": "https://1200km.com/anomaly-detection-atlas/families/peer-group/", "anomaly-sequence": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "case-sequence-unc3944-saas": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "case-sequence-bazarcall-conti": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "family-sequence": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "figure-family-sequence": "https://1200km.com/anomaly-detection-atlas/families/sequence/", "anomaly-graph-relationship": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "case-graph-relationship-midnight-blizzard-2024": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "case-graph-relationship-storm1283-2023": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "family-graph-relationship": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "figure-family-graph-relationship": "https://1200km.com/anomaly-detection-atlas/families/graph-relationship/", "anomaly-geographic-asn": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "case-geographic-asn-unc5537-snowflake-2024": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "case-geographic-asn-midnight-blizzard-2024": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "family-geographic-asn": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "figure-family-geographic-asn": "https://1200km.com/anomaly-detection-atlas/families/geographic-asn/", "anomaly-identity-access": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "case-identity-access-unc3944-saas": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "case-identity-access-storm0558-2023": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "family-identity-access": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "figure-family-identity-access": "https://1200km.com/anomaly-detection-atlas/families/identity-access/", "anomaly-rare-process-service": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "case-rare-process-service-bazarcall-conti": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "case-rare-process-service-messagetap-2019": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "family-rare-process-service": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "figure-family-rare-process-service": "https://1200km.com/anomaly-detection-atlas/families/rare-process-service/", "anomaly-parent-child": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "case-parent-child-lemon-duck-exchange": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "case-parent-child-doejocrypt-exchange": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "family-parent-child": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "figure-family-parent-child": "https://1200km.com/anomaly-detection-atlas/families/parent-child/", "anomaly-data-movement": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "case-data-movement-unc5537-snowflake-2024": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "case-data-movement-unc3944-saas": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "family-data-movement": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "figure-family-data-movement": "https://1200km.com/anomaly-detection-atlas/families/data-movement/", "anomaly-protocol-application": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "case-protocol-application-sunburst-2020": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "case-protocol-application-oilrig-rdat-2020": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "family-protocol-application": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "figure-family-protocol-application": "https://1200km.com/anomaly-detection-atlas/families/protocol-application/", "anomaly-negative-absence": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "case-negative-absence-scarleteel-2023": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "case-negative-absence-aukill-2023": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "family-negative-absence": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "figure-family-negative-absence": "https://1200km.com/anomaly-detection-atlas/families/negative-absence/", "anomaly-state-change": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "case-state-change-storm1283-2023": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "case-state-change-moveit-lemurloot": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "family-state-change": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "figure-family-state-change": "https://1200km.com/anomaly-detection-atlas/families/state-change/", "anomaly-multi-event-correlation": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "case-multi-event-correlation-unc3944-saas": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "case-multi-event-correlation-bazarcall-conti": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "family-multi-event-correlation": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "figure-family-multi-event-correlation": "https://1200km.com/anomaly-detection-atlas/families/multi-event-correlation/", "anomaly-evidence-index": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "anomaly-topic-tags": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-cloud": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-network": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-identity": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-endpoint": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-insider": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-ot": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-telemetry-health": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "tag-application": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "anomaly-reuse-validation": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "incident-register": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "figure-incident-register": "https://1200km.com/anomaly-detection-atlas/research/incidents/", "3-mapping-anomalies-to-the-attck-lifecycle": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "reconnaissance": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "resource-development": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "initial-access": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "execution": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "persistence": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "privilege-escalation": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "defense-evasion": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "defense-impairment": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "credential-access": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "discovery": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "lateral-movement": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "collection": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "command-and-control": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "collection--exfiltration": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "impact": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "attack-mapping": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "figure-attack-mapping": "https://1200km.com/anomaly-detection-atlas/research/attack-mapping/", "4-evidence-register-real-apt-campaigns-and-documented-anomaly-patterns": "https://1200km.com/anomaly-detection-atlas/research/cases/", "41-sunburst--unc2452-2020": "https://1200km.com/anomaly-detection-atlas/research/cases/", "42-hafnium--exchange-proxylogon-2021": "https://1200km.com/anomaly-detection-atlas/research/cases/", "43-conti-ransomware-20212022": "https://1200km.com/anomaly-detection-atlas/research/cases/", "44-apt34--oilrig-dns-tunneling-20182024": "https://1200km.com/anomaly-detection-atlas/research/cases/", "45-moveit--cl0p-campaign-2023": "https://1200km.com/anomaly-detection-atlas/research/cases/", "46-midnight-blizzard--cozy-bear-20232024": "https://1200km.com/anomaly-detection-atlas/research/cases/", "47-scattered-spider--unc3944-2023": "https://1200km.com/anomaly-detection-atlas/research/cases/", "48-storm-0558-and-oauth-abuse-campaigns-2023": "https://1200km.com/anomaly-detection-atlas/research/cases/", "49-volt-typhoon-20232024": "https://1200km.com/anomaly-detection-atlas/research/cases/", "410-apt41--winnti--messagetap-2019-and-m-trends-2025-exfiltration-2024": "https://1200km.com/anomaly-detection-atlas/research/cases/", "411-cisa-aa22277a--impacket-lateral-movement-in-defense-industrial-base-compromise-2022": "https://1200km.com/anomaly-detection-atlas/research/cases/", "412-lazarus-group--dprk--3cx-supply-chain-2023": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-sunburst": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-exchange": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-conti": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-oilrig": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-moveit": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-midnight": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-unc3944": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-storm": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-volt": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-apt41": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-impacket": "https://1200km.com/anomaly-detection-atlas/research/cases/", "case-3cx": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-sunburst": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-exchange": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-conti": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-oilrig": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-moveit": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-midnight": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-unc3944": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-storm": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-volt": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-apt41": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-impacket": "https://1200km.com/anomaly-detection-atlas/research/cases/", "figure-case-3cx": "https://1200km.com/anomaly-detection-atlas/research/cases/", "5-detection-by-log-source-and-security-device": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "51-windows-security-event-log": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "52-sysmon": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "53-edr-platforms": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "54-network-detection-and-response": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "55-identity-and-access-management-platforms": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "56-cloud-security-services": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "57-dns-security": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "shannon-entropy-for-dns-anomaly-detection": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "58-saas-audit-logs": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "59-detection-source-prioritization-matrix": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "telemetry-contract": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-windows": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-sysmon": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "crowdstrike-falcon": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "microsoft-defender-for-endpoint-mde": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-edr": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "zeek--corelight": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "vectra-ai": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-ndr": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-iam": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "microsoft-sentinel--anomaly-analytics": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-cloud": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "dns-entropy": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-saas": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "source-prioritization": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-telemetry-contract": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-windows": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-sysmon": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-edr": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-ndr": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-iam": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-cloud": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-dns-entropy": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-saas": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "figure-source-prioritization": "https://1200km.com/anomaly-detection-atlas/research/telemetry/", "6-credential-based-attacks-detection-engineering-deep-dive": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "61-kerberoasting": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "62-dcsync": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "63-pass-the-hash": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "64-lsass-credential-dumping-sysmon-event-10": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "credential-kerberoast": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "credential-dcsync": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "credential-pth": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "credential-lsass": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "figure-credential-kerberoast": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "figure-credential-dcsync": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "figure-credential-pth": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "figure-credential-lsass": "https://1200km.com/anomaly-detection-atlas/research/credentials/", "7-how-attackers-suppress-anomaly-visibility": "https://1200km.com/anomaly-detection-atlas/research/visibility/", "visibility-limits": "https://1200km.com/anomaly-detection-atlas/research/visibility/", "figure-visibility-limits": "https://1200km.com/anomaly-detection-atlas/research/visibility/", "8-detection-engineering-patterns-and-logic-examples": "https://1200km.com/anomaly-detection-atlas/research/queries/", "81-four-core-design-patterns": "https://1200km.com/anomaly-detection-atlas/research/queries/", "82-detection-logic-examples": "https://1200km.com/anomaly-detection-atlas/research/queries/", "distributed-password-spray--rate-and-shape": "https://1200km.com/anomaly-detection-atlas/research/queries/", "kerberoasting--rc4-tgs-volume": "https://1200km.com/anomaly-detection-atlas/research/queries/", "dcsync--replication-guids-from-non-dc-account": "https://1200km.com/anomaly-detection-atlas/research/queries/", "pass-the-hash--ntlm-network-logon-heuristic": "https://1200km.com/anomaly-detection-atlas/research/queries/", "lsass-credential-access--sysmon-event-10": "https://1200km.com/anomaly-detection-atlas/research/queries/", "web-server-process-spawning-shell-interpreter": "https://1200km.com/anomaly-detection-atlas/research/queries/", "dns-tunneling--shannon-entropy-on-subdomain": "https://1200km.com/anomaly-detection-atlas/research/queries/", "saas-bulk-download-anomaly-m365-sharepoint--onedrive": "https://1200km.com/anomaly-detection-atlas/research/queries/", "83-reproduction-and-evidence-levels": "https://1200km.com/anomaly-detection-atlas/research/queries/", "analytic-contract": "https://1200km.com/anomaly-detection-atlas/research/queries/", "validation-levels": "https://1200km.com/anomaly-detection-atlas/research/queries/", "figure-analytic-contract": "https://1200km.com/anomaly-detection-atlas/research/queries/", "figure-validation-levels": "https://1200km.com/anomaly-detection-atlas/research/queries/", "9-implementation-guidance": "https://1200km.com/anomaly-detection-atlas/research/validation/", "91-instrument-before-modelling": "https://1200km.com/anomaly-detection-atlas/research/validation/", "92-prioritise-by-baseline-stability": "https://1200km.com/anomaly-detection-atlas/research/validation/", "93-baseline-by-role-not-by-estate": "https://1200km.com/anomaly-detection-atlas/research/validation/", "94-accumulate-weak-signals-via-entity-risk-scoring": "https://1200km.com/anomaly-detection-atlas/research/validation/", "95-validate-with-purple-team-exercises": "https://1200km.com/anomaly-detection-atlas/research/validation/", "96-a-reproducible-statistical-study": "https://1200km.com/anomaly-detection-atlas/research/validation/", "97-revision-reproducibility-and-remaining-work": "https://1200km.com/anomaly-detection-atlas/research/validation/", "10-conclusion": "https://1200km.com/anomaly-detection-atlas/research/validation/", "operational-workflow": "https://1200km.com/anomaly-detection-atlas/research/validation/", "study-splits": "https://1200km.com/anomaly-detection-atlas/research/validation/", "study-results": "https://1200km.com/anomaly-detection-atlas/research/validation/", "figure-operational-workflow": "https://1200km.com/anomaly-detection-atlas/research/validation/", "figure-study-splits": "https://1200km.com/anomaly-detection-atlas/research/validation/", "figure-study-results": "https://1200km.com/anomaly-detection-atlas/research/validation/", "11-references": "https://1200km.com/anomaly-detection-atlas/research/references/", "incident-primary-sources": "https://1200km.com/anomaly-detection-atlas/research/references/", "statistical-and-implementation-references": "https://1200km.com/anomaly-detection-atlas/research/references/", "additional-incident-and-correction-references": "https://1200km.com/anomaly-detection-atlas/research/references/", "companion-research": "https://1200km.com/anomaly-detection-atlas/research/references/", "follow-my-work": "https://1200km.com/anomaly-detection-atlas/research/references/", "follow-for-practical-cybersecurity-research": "https://1200km.com/anomaly-detection-atlas/research/references/", "figure-research-map": "https://1200km.com/anomaly-detection-atlas/research/" }, "unlinked_models": [] }