Event Ingestion Volume Drop Anomaly
This rule detects an anomalous drop in the daily volume of events in a dataset. It calculates the average daily volume over the past 6 days (excluding the current day) as a baseline. It then flags if the current day's volume is less than 80% of this baseline, but only if the baseline itself is greater than 1000 events. This indicates a significant decrease in expected activity, which could suggest a sensor outage, tampering, or a system being taken offline unexpectedly.
Cortex XDR
