Cadence Types

Each detection mechanism has its own cadence configuration. You can configure the cadence for each mechanism separately.

File system pattern evaluation

file-access

• File creation/modification patterns
• Suspicious access sequences
• Unauthorized access attempts
• Permission changes

Network endpoint pattern evaluation

network-peers

• Suspicious domain connections
• Threat actor communications
• Unusual peer patterns
• DNS resolution anomalies

Network flow pattern evaluation

network-flows

• Abnormal traffic volumes
• Unusual protocol usage
• Data exfiltration patterns
• C2 communications

Deprecated

env-vars is deprecated. Environment variables are never collected, the key is still accepted in the configuration file and ignored.