Tuning behavioral models for your shop.
Behavioral models ship with sensible defaults, but every environment has its own normal. Tuning is how you tell the models which signals matter for your shop — by class and by entity — without forking a single detection.
Weight the signal classes
Each behavioral model blends four signal classes — identity, endpoint, cloud, and network. The default blend is balanced; a shop with a hardened endpoint fleet but a sprawling identity surface should lean the weights toward identity so the models spend their sensitivity where your risk actually is.
YAMLmodels/weights.yml version: 1 profile: acme-prod weights: identity: 1.4 # we live and die by the IdP endpoint: 1.0 cloud: 1.1 network: 0.7 # flat, well-segmented — less signal here floor: min_confidence: 0.6 # never surface below this
Per-entity baselines
A global threshold treats a chatty CI runner and a dormant service account the same. Per-entity baselining holds each entity to its own history, so the same model is quiet for the runner's nightly burst and loud the first time the dormant account wakes up.
| Setting | What it controls |
|---|---|
window | How far back the baseline learns from — 14 to 30 days is typical. |
warmup | How long a new entity is observed before it can trigger; avoids cold-start noise. |
freeze | Pin a baseline during a known change (migration, launch) so it doesn't learn the anomaly as normal. |
Review what changed
Never tune blind. td model diff shows how a weight or baseline change shifts the match rate before you ship it, so a tweak that silences real signal is caught in review, not in production.
SHELLpreview a tuning change $ td model diff ./models/weights.yml --since 14d -> identity 1.0 -> 1.4 . endpoint 1.0 . network 1.0 -> 0.7 -> match rate: 42/day -> 51/day (+21%) -> newly silenced: 0 high-confidence . 6 low-confidence ok review the 9 new matches at /models/_preview/diff
Where to go next
- Detection-as-code — put a tuned model to work in a rule.
- Detection pipeline — where models run in the stream.