Behaviour settings

The behaviour of the model can be modified tuning it's more relevant parameters. Those parameters are available under the Settings tab.

Each model exposes different parameters, depending on the characteristics it evaluates from the log streams.

Whitelist and blacklist values can be specified individually, but can also be imported from files, formatted as one value per line. This is especially useful for bulk imports, such as large sets of IP addresses or usernames.

Values added to whitelists and blacklists are not used during model retraining, but instead serve as discard criteria at inference time. Each time an inference is generated, these lists are consulted to determine whether the result should be suppressed or escalated, based on analyst-defined rules.