ShieldGate Docs

Advanced

Anomaly detection

UEBA-lite baselines that raise threat scores.

Goal

Use anomaly detection to increase threat scores when behavior exceeds baseline.

Concept

ShieldGate’s anomaly module flags behavior around 3× baseline and feeds threat score increases that policies can act on (IncreaseThreatScore and score-gated rules).

Steps

  1. Ensure anomaly components are enabled in your deployment.
  2. Allow baselines to learn on normal traffic.
  3. Create policies that respond to elevated threat scores.
  4. Monitor analytics for score-driven blocks/challenges.

Verify

  • Synthetic spike above baseline increases score.
  • Policy actions fire only after the threshold you configured.

Tips

  • Do not Enforce aggressive score rules until baselines stabilize.