Anomaly modeling flags a twenty-times spike in city website bandwidth every election night and during council livestreams. What should the hunter add to the model?
Select an answer to reveal the explanation.
Short Explanation
Election night is supposed to look like a packed stadium, not a quiet Tuesday. If the anomaly model has no civic calendar, every council livestream looks like an attack. Bake those expected events into the model so real oddities still stand out.
Full Explanation
Modeling-based hunts compare activity to a baseline. Civic baselines must include known high-traffic events such as elections and council livestreams, or the model will fire on anticipated load. Removing websites from monitoring, auto-isolating the farm, or substituting a hash lookup discards the model instead of giving it municipal context.