thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Baseline

A documented reference of normal system, network or user behavior used to identify anomalies.

Definition

Baselines cover metrics such as traffic volumes, protocol mix, login patterns, running processes and resource usage. Anomaly-based detection, UEBA and threat hunting depend on accurate baselines. Baselines must be updated as the environment changes.

Example

Normal outbound traffic from a web server averages 2 GB per day.

Exam tip

Anomaly detection questions require a baseline first; without one you cannot define "abnormal".

Related terms