Learn What Is Normal—Then Teach Context Without Teaching the System to Ignore Attacks

Observe → Learn → Compare → Correlate → Investigate

The purpose of a baseline is not to decide “good” or “bad.” It is to give current activity tenant-specific historical context.

Learn the Application You Actually Operate

A behavior baseline becomes useful when it reflects the monitored history of the current customer and application domain rather than a generic global average.

The baseline inventory is tenant-scoped. One customer or application domain does not train another tenant’s behavior history. That isolation keeps “normal” tied to the environment where it was actually observed.

“Unusual” Is Not the Same Thing as “Malicious”

First-seen and unusual behavior can be valuable because it tells the analyst what changed. The product keeps that signal in proportion.

Digital Intelligence can surface a new, rare, unexpected, or otherwise unusual behavior queue and explain why a behavior received novelty context, then link directly to immutable proof. It can also show temporal context such as a new or unusual event following a recorded component update when both occur within the supported comparison window.

Correlation in time is not automatic causation. A new destination after a deployment may be a legitimate integration. A first-seen privileged route may be part of an approved workflow. The system should raise the question and preserve the proof—not invent intent.

Teach the System About Exact Context, Not About Entire Applications

Human feedback is powerful enough to reduce noise, so its scope needs to be deliberately narrow and auditable.

Make Learned Trust Auditable and One-Way Scoped

The trust ledger is designed to show exactly what the analyst taught Digital Intelligence and what that decision changes.

Each decision can expose its decision type, scope type, one-way scope fingerprint, approving user, creation time, expiry, analyst reason, linked investigation, supporting evidence, and related response context. The fingerprint is intentionally one-way so the system can prove which exact scope a decision applies to without storing a reversible copy of sensitive subject data in the ledger.

There is deliberately no “trust this entire application” shortcut in this model. Broad trust is convenient until it suppresses the next real attack.

Use Baselines and Trust to Add Context to Investigations—not to Replace Them

Behavior and trust are supporting intelligence layers. The source of truth remains the monitored application evidence and the case built from it.

When a behavior is new or unusual, analysts can open the Evidence Ledger to inspect the proof or move into Investigations when the evidence is part of a larger attack story. Destination history and browser novelty also connect naturally to Data Exposure & Movement.

This creates a controlled feedback loop: evidence establishes the facts, baseline history explains what is familiar, deterministic correlation evaluates the security context, the analyst records an exact decision, and future interpretation becomes smarter without making the evidence disappear.