Anomaly modeling flags a twenty-times spike in city website bandwidth every election night and during council livestreams. What should the hunter add to the model?
Select an answer to reveal the explanation.
Short Explanation
Election night is supposed to look like a packed stadium, not a quiet Tuesday. If the anomaly model has no civic calendar, every council livestream looks like an attack. Bake those expected events into the model so real oddities still stand out.
Full Explanation
Modeling-based hunts compare current activity to a baseline of expected behavior, so the baseline must include known civic-calendar context or it will treat anticipated load as malice. When anomaly modeling flags a twenty-times spike in city website bandwidth every election night and during council livestreams, the hunter should include those expected civic-calendar events in the model so election-night and livestream traffic is treated as context, not a default anomaly. Removing all civic websites from monitoring so livestreams never appear discards visibility the SOC needs for real attacks on the same sites. Converting every bandwidth spike into automatic Adaptive Response isolation of the web farm weaponizes false positives and can take election or council communications offline. Replacing the model with a static malware-hash lookup so calendars are unnecessary abandons modeling entirely and cannot explain calendar-driven volume. Exam caveat: civic anomaly models need municipal calendar awareness—elections, council meetings, tax deadlines—otherwise Domain 6.1 modeling produces noise instead of signal. Operational check: add election nights and scheduled council livestream windows to the model's allow-list or seasonal baseline, rerun the anomaly logic on a prior election night, and confirm those spikes no longer page as unexplained outliers while unexpected off-calendar spikes still do.