Transmission 05 · Detection

Baseline or It Didn’t Happen

Every anomaly detection pitch contains a hidden assumption: that you know what normal looks like. Most environments do not. Without a baseline, “anomalous” is a guess, machine learning is noise amplification with a dashboard, and the alert queue fills with the unfamiliar rather than the hostile.

A baseline is a commitment, not a snapshot

The steady state worth defending is written down, versioned, and enforced: which identities hold which privileges, which services speak to which, what egress is expected, what change is routine. It is the score the orchestra agreed to play — without it, no one can name the wrong note.

Practical baselining, in order

• Egress first: enumerate and allowlist outbound destinations for servers. Unknown egress is the highest-value anomaly in security.
• Privileged identity map: who can touch the crown jewels, reviewed until the answer stops surprising you.
• Service-to-service graph: what talks to what. Attack paths hide in edges nobody remembers creating.
• Change rhythm: deploy windows, patch cadence, admin-activity hours — time is a baseline dimension too.

Variance becomes signal

Once the steady state is explicit, detection inverts: instead of hunting evil in an infinite space, you flag departure from a finite one. This is how the field on this site works — motion is visible precisely because the grid holds still. It is also why baselining is the prerequisite for reading your exposure field and the foundation under signal integrity.

Know the reference, and every distortion names itself. We synchronize.