Rare Event Detection

    • Enable All Rare Event Detection: If the flag is on, it will treat any patterns whose number is lower than the Rare Event Cluster Size as rare events. Generally, the project will get more rare events. (Default: OFF)
  • Sensitivity:
  • Rare Event Cluster Size: For the events grouped in one pattern, if the number of this group is less or equal to the number you set. These events are identified as rare events. The higher, the more rare events you get. (Default: 1)
  • Rare Event Base Score: The base score of the rare event. Determine the importance of the rare event in the system. (Default: 5)
  • Rare Event Number Limit: The maximum rare events grabbed for doing the Causal Analysis and Global View (Ranked by the anomaly event score) The higher the number, the more time needed for these processing (Default: 20)