After the initial period, anomaly detection can reliably begin. However, because “normal” is a moving target, the machine learning doesn’t stop. Baselining continues in 30-day shifts: assessing levels, interpreting communication, accounting for new activity, self-correcting where needed, and generating weekly anomaly reports.
Meanwhile, all you did was choose and enable the type of anomaly alerting you want.
An alert threshold – to you, a simple “sensitivity” slider - is based on optimal standard deviation values, defining how extreme an anomaly will trigger the alert. When detected behavior falls outside the set threshold, you receive notification with enough information to effectively investigate, prioritize, and respond.