Adjust Sanctioned IT Anomaly Thresholds
Adjusting your anomaly sensitivity is vital for successful Threat Detection, as it will ultimately reduce false positives and focus your security response team's efforts on true threats.
Administrators may want to manually adjust anomaly detection thresholds to control the generation of new anomalies. Only a user with the Incident Manager role and the Anomalies resource assigned can view and adjust Anomaly Thresholds or create exceptions.
IMPORTANT: Threshold adjustments may take up to two minutes to take effect in the UI and the anomaly generation process. Threshold tuning is not applied retroactively. It only impacts anomalies in the future.
To Adjust Anomaly Thresholds:
- Go to Incidents > Anomalies > Anomalies.
- Select the required items from the following filters. For example, we have selected Box as the Service Name and Data Anomalies as the Anomaly Category:
- Service Name
- Anomaly Category
- Under Actions, click Adjust Anomaly Thresholds.
- Use the slider to adjust the thresholds for your selected items. Adjusting the slider automatically updates the user-defined threshold values.
- Slider.
- Drag the slider to the right to set the higher threshold and generate fewer anomalies.
- Drag the slider to the left to set the lower threshold and generate more anomalies.
- System Default. Displays the predefined threshold values for anomaly detection at hourly, daily, weekly, and monthly intervals.
- User Defined. Displays the customized threshold values for anomaly detection at hourly, daily, weekly, and monthly intervals.
- Slider.
- Click Save.
IMPORTANT: On the Adjust Anomaly Threshold Level page, the slider returns to the middle position, though your changes are saved. The slider bar will always be in the middle position. However, the values in the System Default and User Defined row reflects your most recent change.
You can view the saved threshold value in the Threshold Value field on the Anomaly Cloud Card. For details, see Anomaly Cloud Card.