Anomaly detection visual index

Atlas home · Research path · Operational families · Anomaly models · Visual index

All 55 current diagrams and infographics are integrated beside their explanations. Each contextual view includes source links, an evidence label, an accessible text equivalent, and the unchanged full-size file. This index does not load 55 large images at once. Historical illustrations are not current guidance.

Figure 1: From anomaly to investigation — CONCEPTUAL MODEL. Full-size asset.
Figure 2: Point anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 3: Contextual anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 4: Collective anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 5: Malicious-behaviour correlation — CONCEPTUAL WORKFLOW · USER-SUPPLIED. Full-size asset.
Figure 6: Rare events change alert precision — ILLUSTRATIVE ARITHMETIC. Full-size asset.
Figure 7: Volumetric anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 8: Frequency / rate anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 9: Temporal anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 10: Peer-group anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 11: Sequence anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 12: Graph / relationship anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 13: Geographic / ASN anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 14: Identity / access anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 15: Rare process / service anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 16: Parent–child execution anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 17: Data movement anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 18: Protocol / application usage anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 19: Negative / absence anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 20: State-change anomaly — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 21: Multi-event correlation — SYNTHETIC ILLUSTRATION · USER-SUPPLIED. Full-size asset.
Figure 22: Incident register: evidence boundaries — ARTICLE SCOPE SNAPSHOT · USER-SUPPLIED. Full-size asset.
Figure 23: Map behavior, then ask what is measurable — CONCEPTUAL MODEL. Full-size asset.
Figure 24: SUNBURST: encoded DNS is evidence, not a verdict — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 25: Exchange: distinguish HAFNIUM from broader exploitation — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 26: BazarCall to Conti: one documented investigation — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 27: OilRig-associated RDAT: identify the actual channel — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 28: MOVEit: follow application and database evidence — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 29: Midnight Blizzard: preserve identity and permission context — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 30: UNC3944: correlate identity changes and SaaS activity — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 31: Storm campaigns: keep token abuse and OAuth cases separate — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 32: Volt Typhoon: distinguish initiation and execution hosts — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 33: APT41: two investigations, not one constructed chain — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 34: CISA AA22-277A: tool use is not attribution — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 35: 3CX: a valid signature is not a benign verdict — SOURCE-REPORTED + AUTHOR INFERENCE · USER-SUPPLIED. Full-size asset.
Figure 36: A field name is not a collection guarantee — CONCEPTUAL MODEL. Full-size asset.
Figure 37: Windows events: verify channel and effective audit policy — SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIED. Full-size asset.
Figure 38: Sysmon: event availability depends on configuration — SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIED. Full-size asset.
Figure 39: EDR: separate event identity from process correlation — SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIED. Full-size asset.
Figure 40: Network visibility depends on the observation point — SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIED. Full-size asset.
Figure 41: Identity events: inspect the actor, target and outcome — SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIED. Full-size asset.
Figure 42: Cloud evidence: distinguish raw events and provider findings — SOURCE REFERENCE · COLLECTION-DEPENDENT · USER-SUPPLIED. Full-size asset.
Figure 43: DNS entropy measures symbol distribution, not intent — EXACT MATH · SYNTHETIC LABELS · USER-SUPPLIED. Full-size asset.
Figure 44: SaaS audit: events, objects and transferred bytes differ — EXACT ARITHMETIC · SYNTHETIC RECORDS · USER-SUPPLIED. Full-size asset.
Figure 45: Prioritize sources using measured local value — PROPOSED PLANNING FRAMEWORK · USER-SUPPLIED. Full-size asset.
Figure 46: Kerberoasting: service-ticket evidence is not recovery — CONCEPTUAL DETECTION GUIDE · USER-SUPPLIED. Full-size asset.
Figure 47: DCSync: retain uncertain source attribution — CONCEPTUAL DETECTION GUIDE · USER-SUPPLIED. Full-size asset.
Figure 48: Pass-the-Hash: two hunting views, no single verdict — CONCEPTUAL DETECTION GUIDE · USER-SUPPLIED. Full-size asset.
Figure 49: LSASS: decode access rights, then establish provenance — CONCEPTUAL DETECTION GUIDE · USER-SUPPLIED. Full-size asset.
Figure 50: A detector can miss at different layers — CONCEPTUAL MODEL. Full-size asset.
Figure 51: Make the analytic reproducible — CONCEPTUAL MODEL. Full-size asset.
Figure 52: What the tests actually establish — RECORDED RESULTS · SCOPED CLAIMS. Full-size asset.
Figure 53: Close the loop before operational use — CONCEPTUAL MODEL. Full-size asset.
Figure 54: Freeze the experiment before the test — SEEDED SYNTHETIC EXPERIMENT. Full-size asset.
Figure 55: Corroboration reduces alerts and recall — SYNTHETIC RESULTS · NOT PRODUCTION. Full-size asset.

Original visual manifest · Import provenance