The learning phase
A behavioural detection system without a baseline is a random alert generator. Nyxtrace therefore spends its first weeks learning, and deliberately suppresses its own findings while it does.
This is the single most common source of “is it broken?” on a new installation. It is not broken. An empty incident list with a green hourly analysis timer is the correct state.
The numbers
Section titled “The numbers”| Requirement | Value |
|---|---|
| Learning period | 14 days by default, configurable from 14 to 28 |
| Rarity prior window | 14 days of prior observation before a destination counts as new |
| Robust baseline | at least 8 comparable hourly samples for that hour-of-week |
| Beaconing | at least 5 intervals, with a coefficient of variation ≤ 0.15 |
| Scan | at least 20 unique ports within 60 seconds |
| Peer groups | at least 24 hours of history, a minimum group size, and a minimum number of devices in the tenant |
Note that the requirements are per device and per feature, not global. A device that appeared yesterday is in its own learning phase even if the appliance has been running for a month. That is why a merge in the identity model keeps the earlier first-seen timestamp: a device whose MAC rotates must not have its learning phase restart every few days.
What happens during it
Section titled “What happens during it”The hourly analysis runs normally. It computes every model result and stores it with score 0, marked as a learning baseline. Nothing is thrown away: when the requirements are met, the same evidence starts producing scored results.
So during the learning phase you can, and should, check:
- that devices are appearing in the inventory,
- that the globe draws arcs,
- that the system view shows every source fresh,
- that the analysis timer ran successfully in the last hour,
- that model results exist in the store.
What you cannot check is whether detection is any good. That needs the baseline.
Why 14 days minimum
Section titled “Why 14 days minimum”Because a week is not enough to know a week. The baselines are keyed on hour-of-week — a device’s Tuesday 03:00 is a different bucket from its Sunday 19:00 — and eight comparable samples for a given bucket cannot exist until several weeks have passed for the rarer buckets.
Fourteen days is the floor at which the daily patterns are established and the weekly ones are beginning to be. The configurable range goes to 28 for installations that would rather be quiet longer.
What it cannot be replaced with
Section titled “What it cannot be replaced with”Not by synthetic data. Not by a fixture. Not by importing someone else’s baseline. The value of the baseline is that it is yours — a camera that uploads nightly in your network is normal precisely because it does so in your network.
An operational acceptance for the whole appliance is therefore a two-to-four week activity that runs in parallel with the technical checks, and it is measured by the thing that actually matters: is the output useful, against the false-positive rate.
After it
Section titled “After it”Expect a burst. When the suppression lifts, the first genuinely new things start scoring, and some of them will be wrong. Use false-positive feedback — it records tenant-scoped human judgement and feeds the triage proposals a person then reviews. Nothing retrains itself behind your back.