Establishing a Baseline of Normal Patterns

Use broader profiles and more frequent snapshots to capture an example of all the patterns that occur as part of normal business practices. identifying normal patterns takes time and investigation, and requires that you be familiar with traffic in your enterprise.

Once you have identified normal patterns, use annotation for moving them out of the analysis workflow. You can also use filters, but it is more reliable to move patterns by annotating them to a stage, such as Closed, because it assures that the pattern has been inspected and classified. For instructions about how to use event annotation to manage Pattern Discovery workflow, see Annotating Patterns.