Anomaly detection
What it does
Flags agents behaving outside their normal pattern, from the audit trail; early warning of a compromised agent.
It builds a baseline from each agent's audit history and flags behaviour that departs from it, a sudden change in tools, volume, destinations, or timing, surfacing the agent for review rather than blocking blindly.
When it applies
Continuously, once an agent has enough history to form a baseline.
How it works
Each agent is baselined from its recent audit history, and the most recent window is compared against that baseline to flag denial bursts, first-time tools, volume spikes, and off-hours activity.
In practice
A compromised agent suddenly using a new tool at three in the morning is flagged for investigation.
What you get
The flagged anomalies, with severity, are derived from and traceable to the audit trail.
Why it matters
Early warning that an agent may be compromised or drifting.
A compromised or drifting agent often looks legitimate call-by-call; the tell is a change from its own normal pattern. Anomaly detection is the early warning that a routed agent has been hijacked or is misbehaving, before the damage is done.