12 identities have no established baseline
Anomaly detection cannot fire for an identity whose normal is unknown. Until the baseline settles, these identities are covered only by static threshold policies, which is a materially weaker control.
Identities baselined
56
Coverage
82%
Still learning
12
Deviations detected
49
What a deviation actually looks like
Rows read per night by svc_scheme_sync against its established band. Twenty nights of ~3,600 rows, then 148,200 in ninety-three minutes. A static threshold set high enough to avoid daily noise would have missed this; a baseline caught it in minutes.
68 identities
1–25 of 68
1 / 3