baseline
baseline
Surface what is new for a host, user, or IP — the values it has not done before in its own recent history — so you can hunt "what changed for this entity?" without opening a case.
Description
The baseline command answers a single question: given everything this entity did before my search window, what appears in the window that it has never done? It takes the entity implied by your search (or one you name), looks back over a lookback window before the search range, and reports the values that are new relative to that history — new processes, new destination IPs, new users, new ports — each tagged with a coverage flag telling you how much history it had to judge against.
This is the ad-hoc form of nano's entity baselining: the same new-to-entity engine the shadow investigator runs automatically on a new case, exposed as a command so it is first-class in the hunt bar. It reuses the entity's activity history to gate its conclusions, so a brand-new or freshly-imaged entity — which has done everything for the first time — is reported as unknown, never as anomalous.
Syntax
... | baseline [host=|user=|ip="<value>"] [window=<duration>] [dims=<field,field>]Optional Arguments
host / user / ip
Syntax: host="<value>" | user="<value>" | ip="<value>"
Description: The entity to baseline, given explicitly. If omitted, the entity is inferred from the search filter — src_host/dest_host → host, src_ip/dest_ip → ip, user/src_user/dest_user → user (the same detection asset uses).
Values: A single host, user, or IP value.
Default: Inferred from the search.
window
Syntax: window=<duration>
Description: How far back before the search range to look for prior activity. Values that are new relative to this lookback are what get reported. The lookback scans raw logs per dimension, so it is deliberately bounded.
Values: 1d to 90d. Windows beyond the cap are rejected.
Default: 7d
dims
Syntax: dims=<comma-separated fields>
Description: Restrict the baseline to specific dimensions. By default all dimensions available for the entity type are reported.
Values: process_name, dest_ip, src_ip, src_host, user, dest_port (whichever apply to the entity type — see Dimensions).
Default: All dimensions for the entity type.
Coverage — absence of evidence is not evidence
Every row carries a coverage value, because "this entity has never done X" only means something if the entity has enough history to have done X before. Coverage is computed from the entity's activity in the lookback window:
| Coverage | Meaning | New-to-entity rows |
|---|---|---|
sufficient | Enough history (≥ 3 active days and ≥ 50 events) to trust a "never seen before" call | Reported |
thin | Some history, but not enough to be confident | Reported, but treat as a lead, not a verdict |
no_history | No activity at all in the lookback — the entity is effectively new | Suppressed — nothing is called "new" |
Rows also carry baseline_unknown. It is true when the result cap filled entirely with new values, so the baseline could not be established (either the entity was genuinely never watched, or 100+ first-sightings landed at once — a scan). In that case the values are shown with a caveat rather than asserted as confirmed first-sightings.
The baseline window excludes the search window itself. History ends where your search range begins, so a noisy window can never become its own baseline and normalise itself away.
Output Fields
Each row is one new-to-entity value for one dimension:
| Field | Description |
|---|---|
entity | The entity value being baselined |
entity_type | host, user, or ip |
dimension | Which behaviour is new (e.g. processes, destination IPs, users) |
value | The specific new value (e.g. sc.exe, 65.89.243.45) |
count | Occurrences of the value inside the search window |
first_seen | When the value first appeared for this entity |
coverage | sufficient / thin / no_history (see above) |
baseline_unknown | true when the baseline could not be established (reported with a caveat) |
When nothing is new, a single summary row is returned carrying the coverage — so an empty result is never ambiguous ("nothing new" vs "no history to judge against").
Dimensions
The dimensions profiled depend on the entity type, and each is anchored so the entity has to be the actor for behaviour that describes it (a remote host's tooling is never credited to the machine it connected to):
| Entity | Dimensions |
|---|---|
host | users on the host, processes it ran, destination IPs it connected to |
user | hosts they logged into, source IPs, processes they ran |
ip | hosts, destination ports, users |
Examples
Baseline a host (entity inferred from the filter)
src_host="ws-fin-001" | baselineName the entity explicitly
* | baseline host="ws-fin-001"Look back 14 days instead of the default 7
* | baseline host="ws-fin-001" window=14dOnly new processes and destinations
src_host="ws-fin-001" | baseline dims=process_name,dest_ipWhat's new for a user
user="jsmith" | baselineWhat's new for an IP
* | baseline ip="10.1.1.50"New processes on a host over the last month
src_host="server-01" | baseline window=30d dims=process_nameUsage Notes
Search range is the current window. baseline treats your search time range as the window under examination and looks back window days before it. Keep the search range tight — it is capped at 7 days, since the baseline scans that window plus the lookback.
Window is bounded. The lookback scans raw logs per dimension, so window is capped at 90 days (default 7d). A larger window is rejected rather than run.
Entity, not free-form. Only host, user, and IP entities have a meaningful behavioural baseline. Artifacts like file hashes and domains are covered by prevalence instead.
Source scope and schema. The baseline honors your source-visibility scope and works under both the UDM and OCSF schema profiles — no configuration needed.
Thin ≠ new. A thin or no_history coverage flag means the "new" call is weak or suppressed. Do not treat a first-sighting on a low-history entity as an anomaly on its own; corroborate with the entity's broader activity.
Related Commands
- asset - Full asset investigation view with identity resolution and activity timeline
- prevalence - Rarity of an artifact across the whole environment (vs. new to one entity)
- lateral - Trace lateral movement paths for a user or host
- retro - Full-history, prevalence-weighted IOC sweep