Which interval is the duration of time before an analytics detector can raise an alert?

The training period is a designated duration during which an analytics detector, specifically an Analytics Behavioral Indicator of Compromise (BIOC) rule, learns the normal patterns and behaviors within a network environment. This process establishes a baseline of activity. During this learning phase, which typically lasts between 14 and 30 days depending on the specific rule, the detector ingests and analyzes data but does not generate any alerts. Only after the training period is successfully completed can the detector begin to identify deviations from the established baseline and raise alerts for anomalous activity.

A. Activation period: This term is not used to describe the learning phase. Activation refers to the action of enabling a rule, which then initiates the training period.
B. Test period: While a detector could be conceptually tested, "Test period" is not the official term used in XSIAM for the mandatory baseline learning phase before alerting begins.
D. Deduplication period: This is a time window applied after an alert has been generated to group subsequent, similar events into the existing alert, thereby reducing alert noise.

1. Palo Alto Networks Cortex XSIAM Administrator's Guide. (Analytics Concepts > Analytics BIOC Rules). The documentation states, "When you first enable an Analytics BIOC rule, the rule enters a training period where it learns the normal behavior in your network. The training period is specific to each rule and can last between 14 and 30 days. During this time, the rule does not generate any alerts." This directly confirms the definition and purpose of the training period.

2. Palo Alto Networks Cortex XSIAM Administrator's Guide. (Manage Your Alerts > Alert Deduplication). This section explains, "To reduce alert fatigue, Cortex XSIAM groups alerts that are related to the same security event in your network... Deduplication occurs when Cortex XSIAM identifies an alert with the same alert key within a specific time frame." This clarifies that deduplication is a post-alerting process.