// baseline
Your normal, approved by you
Every environment is noisy in its own way. Baseline turns that into reviewable claims you approve one at a time, never a silent filter.
// the problem
Every environment is noisy in its own way
Your nightly batch job looks like data exfiltration. Your deployment pipeline looks like privilege escalation. Somebody has to decide what is normal here, and most platforms let that decision happen invisibly, inside a tuning rule nobody reviews.
Tuning detection is a decision about your risk. You should make it, see it written down, and be able to take it back.
// the unit
A baseline is made of facts, not rules
Each fact is one reviewable claim about your environment, written in prose, carrying what it is about and what it rests on.
- Fact
One claim about your environment, either observed by the generation pipeline or asserted by you. The interface always shows which of the two it is.
- Subject
The typed thing a fact is about: an IP, a principal, a cloud account, a region, a time window. Each carries its own approval state.
So approving a fact covers exactly the subjects it named at that moment. A subject discovered later stays inert until approved on its own.
- Evidence
The observations frozen into the fact when it was written — a snapshot, because the underlying signals eventually age out.
- Caution
A prohibition attached to a fact: a subject that must never be muted, however expected it looks.
Attached by our analysts, and binding once you approve the parent fact.
// the four gates
Four gates, and only the last one changes anything
We never say a fact is simply approved. Whose approval, and of what, is the entire point.
Written and attributed. Not visible to you yet, and affecting nothing.
Our internal review has released it to you. You can now read it.
You agree the claim about your environment is true. Detection is still unchanged.
You accept what the fact asks for. This is the only gate that changes live detection.
// what a fact asks for
Approving a claim is not accepting its proposal
A fact can ask for one of three things, and you decide on each separately. Agreeing that something is true says nothing about what should be done about it.
- Suppress — stop showing signals that match. The strongest ask, and the one Cautions exist to fence.
- Downgrade — lower the severity. The signal stays visible; it simply stops shouting.
- Config — establish a per-client list the ingestion pipeline reads, which then shapes what L6 reports
- You can also disown a fact entirely: a claim that the identifiers are not yours at all. That raises an internal escalation on our side rather than being filed as a rejection.
// visibility
You can see what your baseline is currently causing
- Which suppression rules are live, and how wide each one reaches — one cloud account, or every account you own. It defaults to the narrow reading everywhere.
- Which downgrades are in force.
- Which configuration lists the baseline now owns.
- A fact built from an insufficient window is labelled as provisional, alongside the window it was actually built from, so nobody publishes a claim resting on thin data without knowing.
// questions this answers
How detection tuning works, answered directly
Who decides what counts as normal in my environment?
You do. Our analysts author claims about your environment and publish them to you; nothing changes live detection until you approve the claim and then separately accept what it proposes. Approving a claim and accepting its proposal are two different acts.
What are the four baseline gates?
Authored (written by an analyst), Published (released to you by our internal review), Client Approved (you agree the claim is true), and Accepted (you accept what it asks for). Only the fourth gate changes live detection.
Can suppression be applied to my whole organisation by accident?
No. Every suppression carries an explicit scope — one cloud account, or every account you own — chosen per suppression and defaulting to the narrow reading at every seam. Analysts can also attach a caution: a subject that must never be muted however expected it looks.
// keep reading
Where this goes deeper
Want to see this one live?
Book 30 minutes and we will walk through “Your normal, approved by you” in the actual platform, using your environment as the example.