5. Baselining

This section assumes, that you have read the chapter Basic Concepts.

All incoming logs, that do not match an existing case, will show up in the Baselining section. From here you can create cases and define your baseline, meaning every event showing in the baseline is in theory something unknown/new.