Purple › Module 5 › Lesson 3
Baselines
Baselines literacy names normal activity profiles, FP rate thresholds, and noise floors — establish baselines on YOUR $PURPLE_LAB before measuring rule performance.
Visual · t35_baselines
Baselines literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
You cannot tune what you have not measured — literacy teaches detection baselines so FP rates compare against normal lab host activity you document.
Detection baselines capture normal activity on lab hosts — daily PowerShell execution count, admin tool usage patterns, scheduled task frequency. FP rate threshold defines acceptable false alerts per day — e.g., fewer than five FPs per rule on lab baseline week. Noise floor comparison: rule alerts vs baseline before and after tuning. Cyberlium writes baseline row on YOUR $PURPLE_LAB — normal activity metric and FP threshold for one fictional rule. Next: Testing Lab.
1. Baseline components (named)
Activity metric: events per day for technique on lab hosts — e.g., 50 PowerShell launches/day normal. FP threshold: max false alerts acceptable — org-specific, documented. Measurement window: baseline week on $PURPLE_LAB before rule deploy. Comparison: alert count vs baseline after deploy.
On $PURPLE_LAB, write baseline row — metric, normal value, FP threshold for one fictional T1059 rule.
Command guide
Try these commands — Baseline components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma baselines — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide Elastic baselines — https://www.elastic.co/guide/en/security/current/rules-ui.html MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
python3 - <<'PY'
import json, os, collections
lab = os.environ.get('PURPLE_LAB', os.path.expanduser('~/cyberlium-lab/t35-purple'))
path = os.path.join(lab, 'telemetry', 'auth.jsonl')
events = [json.loads(l) for l in open(path)]
fails = [e for e in events if e.get('event_id') == 4625]
by_ip = collections.Counter(e['src_ip'] for e in fails)
print('Baseline: 4625 counts by src_ip (YOUR FAKE telemetry):')
for ip, n in by_ip.items():
print(f' {ip}: {n} failures')
print('Threshold literacy: flag if count >= 3 in 5min window')
PYCommand — copy this
cat > "$PURPLE_LAB/testing/baseline-notes.txt" <<'EOF' Baseline for failed-logon-lab.yml: 203.0.113.77: 3 x 4625 (jsmith) → MATCH purple test case UT-01 10.0.2.10: 1 x 4625 (administrator) → below threshold Tune: add time window + count >= 3 to reduce single-typo FP EOF
Command — copy this
grep -E '203.0.113.77|threshold' "$PURPLE_LAB/testing/baseline-notes.txt"
Primary tools to practice this lesson: jq, python3. Reference sites: Sigma baselines (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic baselines (https://www.elastic.co/guide/en/security/current/rules-ui.html); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why baselines prevent subjective tuning
'Too many alerts' without baseline is opinion. Measured FP rate against documented threshold drives tuning decisions. Purple exercises update baselines when lab host activity changes.
Students document lab baselines on notes — production baselines follow SOC metrics and executive dashboards.
3. Lab boundary
Forbidden: deploying rules without baseline comparison. Allowed: baselines card — metric and threshold with $PURPLE_LAB fictional lab host data.
Ship: baselines card for YOUR lab rule. Next: Testing Lab.
4. What you ship: baselines card for $PURPLE_LAB
Activity metric, normal value, FP threshold. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Baselines card. $PURPLE_LAB named. File t35-m05-l03-baselines.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tune rule because 'it feels noisy' without baseline data. Use stranger host activity as baseline.
Right
Write baselines card for YOUR $PURPLE_LAB. Next: Testing Lab.
Mission: establish baseline on YOUR lab
1) Define activity metric and FP threshold. 2) Write baseline row for one rule. 3) Note measurement window on lab hosts. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Baseline week before deploy — measure normal before you measure signal.
Knowledge Check
APPLY: Detection baselines primarily:
Multiple choice
Knowledge Check
APPLY: True or False: FP threshold defines acceptable false alerts per measurement window.
True or False
Knowledge Check
APPLY: Baselines literacy on Cyberlium uses:
Multiple choice