Create an Outlier Block

Outlier accelerates and automates the process of identifying a potential threat. It would allow you to investigate and diagnose the specific entity responsible for the suspicious activity. You can automate the process by adding the identified incident as a signal. DNIF also uses a data-driven approach to identify patterns exhibited by the majority of the data and highlights data points that deviate from these patterns. An outlier is an observation which deviates so much from the other observations as to arouse suspicions that it was generated by a different mechanism.

How to add an Outlier block?

• Hover on the Workbooks icon on the left navigation bar of the home screen, it will display the folder-wise view of existing workbooks.
  
  
  
  
• Create a new workbook or open an existing workbook. 
• In the Workbook, click on the plus icon and select Outlier Block from the list.
  
  
  
  
  

This is an independent block i.e. the output obtained is not dependent on the result of any other block. You can add this block along with other blocks in the workbook.

• Enter the details in the fields as explained below:

Field	Description
FIND OUTLIER IN STREAM	Select the preferred stream for outlier detection.
ON	Select the preferred entity for outlier detection. Note: The features are auto-recommended based on the Entity selection; these features will act as filters to narrow down the outlier hunt.
OVER THE	Select the preferred time to view outliers for the chosen time range.
Show outliers(%)	Select the percentage of anomalies you expect to find in the dataset.
Show only anomalous data	Select the checkbox to show only anomalous data
FILTER	Used to filter the features to be displayed in the grid and graph.
Show features contribution	Select the checkbox to view the features that contributed to the anomaly generation. Note: This checkbox is only visible when multiple features are selected.

By default, Firewall as stream and SRCIP as value will be selected. You can select filters as per your requirement.

• Click Run after selecting the required parameters, and the detected outliers will be displayed in a grid and graph format.
  
  
  

• The list of anomalies detected are listed in the grid. It will display all the anomalies along with all the features that were selected for the particular outlier entity and the same anomalies will be indicated as a red dot in the scatterplot. Anomalies will have a negative score while normal data points will have a positive score.
• Click the Feature Plot to view a chart of the feature that caused the anomaly and identify which features had the greatest impact on the detected anomaly.
  
  
  
  
• The anomalies detected can be considered as a security incident and you can raise a signal. To raise a signal refer to the steps in the Create a Signal Block document.
• For more details on details on Workbooks, refer Create a Workbook.