agentsclimarketplace

Establishing telemetry baselines

Skill meltedinhex/analyst-ai-pack/skills/establishing-telemetry-baselines

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill establishing-telemetry-baselines

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Establishes behavioral baselines from historical telemetry (process, network, or logon events) so hunts can flag rare and first-seen activity instead of relying on static signatures. Activates for requests to build a telemetry baseline, find rare or first-seen activity, or compute frequency baselines for anomaly hunting.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

Establishing Telemetry Baselines

When to Use

  • You want to hunt for rare or first-seen behavior (uncommon process names, parent/child pairs, destinations) by comparing current activity to a historical baseline.
  • You are reducing noise by establishing what "normal" looks like before alerting on outliers.

Do not use a baseline built from a compromised period as "normal" — seed it from a known-good window. This skill computes statistics from telemetry and executes nothing.

Prerequisites

  • Historical telemetry (CSV/JSON) with a categorical field to baseline (e.g., process name, parent-child pair, destination host).

Workflow

Step 1: Build the baseline

python scripts/analyst.py baseline history.csv --field Image

Computes per-value counts, frequency (stacked-rank), and the set of values seen, saved as a JSON baseline.

Step 2: Score new activity against the baseline

python scripts/analyst.py compare new.csv --field Image --baseline baseline.json

Flags values not present in the baseline (first-seen) and values below a rarity threshold.

Step 3: Triage outliers

Investigate first-seen and rare values; many will be benign-but-new — corroborate with context.

Step 4: Maintain

Refresh the baseline on a rolling known-good window to avoid drift.

Validation

  • The baseline captures counts and the value set from the historical window.
  • First-seen values in new data are correctly identified as absent from the baseline.
  • Rarity thresholds are explicit and tunable.

Pitfalls

  • Baselining a compromised window, normalizing malicious activity.
  • Too-short baseline windows making common items look rare.
  • High-cardinality fields (full command lines) needing normalization before baselining.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.