Rarity-Based Scoring: A Simpler Alternative

How User and Entity Behavior Analytics products score an event by how rare it is for the specific user or host involved, a minimal runnable rarity scorer, and the Darktrace-style case study of unsupervised baselining in commercial network defence.

~5 min total·4 quadrants of structured content

By the end of this topic, you will

Describe the four-step rarity-scoring algorithm used in UEBA products
Implement a minimal rarity scorer and explain why a never-before-seen activity scores highest
Explain why a learned baseline of normal can itself be wrong, using the Darktrace-style case study

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Video content coming soon.

Quadrant 2 · e-Content

Articles and case studies

Rarity-Based Scoring: A Simpler Alternative

Not every anomaly detector needs to be a trained model. UEBA products commonly score an event by how rare it is for this specific user, not how far it sits from a fitted mathematical boundary.

Quadrant 3 · Web Resources