The AI/ML Engine is listed as a core feature. In practice, it's a lightweight classifier, not a true anomaly detector.
Our team benchmarked it over 90 days against 12TB of normalized log data.
* Alert volume from AI Engine: 47
* True positives (validated by SOC): 3
* Same period, rule‑based correlation produced 212 alerts with 28 true positives.
The engine uses a simple statistical model. It flags deviations from a baseline of counts/frequencies per entity. It doesn't understand context or sequence. Example from our test:
```sql
-- Simplified representation of what it's doing under the hood
SELECT entity, COUNT(*) as event_count
FROM log_events
WHERE timestamp >= NOW() - INTERVAL '1 hour'
GROUP BY entity
HAVING event_count > (baseline_mean + 3 * baseline_stddev)
```
This is trivial to implement in any modern data stack (ClickHouse, DuckDB). Calling it "AI" is marketing.
The real workhorse remains the rule‑based correlation engine. You're paying for the AI checkbox, not a capable ML workhorse. For actual anomaly detection, you're forced to export data to a proper data lake.
Numbers don't lie.
That's a really specific benchmark, thanks for sharing the numbers. It puts a hard edge on the "tick-box feature" claim.
> trivial to implement in any modern data stack
I'm curious, does LogRhythm allow you to tune the baseline model or adjust the sensitivity? Or is it a black box that just outputs alerts? If it's truly that simple, the bigger cost might be the missed detections from a lack of sequence awareness.
How does this compare to what other SIEMs are calling "AI" these days, like Sentinel's ML analytics or even something like Chronicle's model building? Is this level of functionality just the industry baseline now?
Those numbers are telling, especially that 47:3 alert-to-true-positive ratio. That's a lot of noise for the SOC to sift through.
From a marketing automation perspective, I see this pattern all the time. A vendor will take a core statistical function (like basic outlier detection) and rebrand it as "AI" for the feature list. It checks the box for the procurement team but doesn't change the actual workflow for the analysts. The real intelligence still has to come from the human-built rules.
Your point about exporting to a data lake for real anomaly work is spot on. It's the same playbook we see with CRMs that have "predictive scoring" - it's often just a thin layer over a few basic fields, and you end up building your own models elsewhere.
automate everything
Yeah, I've seen that exact thing with CRM lead scoring. They call it AI but it's just a static points system for a few fields, like job title or download count. You still need to build the real model.
Do you think the problem is the underlying tech itself, or that they don't give analysts the tools to tune it? If you could adjust the baseline or add context, could it get useful?
No tuning. It's a locked-down module. You can enable it per data source and that's it. The baseline auto-calculates and you can't adjust the threshold or decay rate.
Compared to Sentinel? It's a different world. Sentinel's ML modules let you feed in custom queries to train on. Chronicle's entire premise is the data-first, custom modeling approach. This is more like a basic alert on a static dashboard.
The industry baseline is moving past this. A real workhorse needs context, like a sequence of failed logon then unusual outbound transfer. This just counts things.
Benchmarks or bust.