Kaspersky Machine Learning for Anomaly Detection

Creating a monitor

The functionality is available after a license key is added.

To create a monitor:

1. In the main menu, select the Event Processor → Monitoring section.
2. Click the Create monitor button.

   The Create monitor pane appears on the right.

3. Specify the name of the monitor in the Name field.
4. To use the monitor to track parameter values, events, or patterns, set State to Active.
5. In the Sliding window (sec.) field, specify the interval (in seconds) from the current point in time back to the time sequence for which the monitor will process incoming values of parameters, events or patterns.
6. In the Activation stack size field, specify the number of monitor activations that must be displayed when viewing information about the monitor.
7. Under Subscription type, select one of the following options:
   • To track the occurrence of certain event parameter values, select Parameter values.
   • To track the occurrence of certain events, select Events.
   • To track the occurrence of patterns in the behavior of the monitored asset, select Patterns.
   • To track unique generalized events or patterns, select Unique generalized.
   • To track similar generalized events or patterns, select Similar generalized.
8. In the Activation parameters block, do the following:
   1. In the Activation threshold field, specify the number of monitor activations in the sliding window after which the monitor sends an alert to the external system.

      This parameter is displayed if Subscription type, Parameter values, or Events is selected in the Patterns settings block.

   2. To track new events, patterns, or event parameter values, set Activation type to Track only new.

      This parameter is displayed if Subscription type, Parameter values, or Events is selected in the Patterns settings block.

   3. In the Attention head drop-down list, select the attention head to focus the monitor's attention on the required directions in the behavior of the monitored asset.

      This parameter is displayed if Patterns, Unique generalized, or Similar generalized is selected under Subscription type.

   4. In the Subscription to events or patterns field, select one of the following options:
      • To track generalized events, select Subscription to events.
      • To track generalized patterns, select Subscription to patterns.

      This parameter is displayed if Unique generalized or Similar generalized is selected under Subscription type.

9. To specify the conditions for activating the monitor when tracking event parameter values, events, or patterns, do the following under Filters:
   1. Perform one of the following actions:
      • To track events for all specified values within a single monitor, set the toggle switch to Track for all values simultaneously.
      • To create child monitors for each specified event parameter value selected from the Event parameter drop-down list, and track their occurrence separately, set the toggle switch to Track for each value.

      The check box is displayed if Events is selected under Subscription type.

   2. In the Event parameter drop-down list, select an event parameter to refine monitor activation conditions for.
   3. In the Filter type drop-down list, select one of the following values:
      • Parameter: to activate the monitor when tracking specific event parameter values.
      • Generalized parameter: to activate the monitor when tracking generalized event parameter values.

        This value can be selected if the monitor is tracking the occurrence of patterns.

      • Attention: to focus the attention of the event processor on a specific event parameter.

        This value can be selected if the monitor is tracking the occurrence of patterns.

      • Generalized attention: to focus the generalized attention of the event processor on the selected parameter.

        This value can be selected if the monitor is tracking the occurrence of patterns.

   4. Perform one of the following actions:
      • To include or generalize all values of an event parameter in attention, select All values from the Value type drop-down list.
      • To include or generalize a specific event parameter value in attention, select Specific values from the Value type drop-down list and enter the relevant value in the Value field. As you start typing a value, all matching parameter values are displayed in the list.
      • To include or generalize event parameter values according to a template in attention, from the Value type drop-down list, select Regular expression and enter the value template using a regular expression in Value.

        You can use special characters of regular expressions to search for events and patterns based on regular expressions.

      • To include or generalize the new values of an event parameter in attention, select New values from the Value type drop-down list.

        This value type is available if the Activation type toggle switch is set to Track only new.

      If necessary, you can specify more than one monitor activation condition. You can delete a previously added condition by clicking next to the condition.

10. Click the Save button.

The new monitor is created and displayed on the Monitoring tab.