Hi everyone I was reading through "endpoint security analyst with Splunk (online experience)" which you can find here: http://si_usecase_02.splunkoxygen.com/en-US/app/OLE_Security_Endpoint/sec_search_01?tour=gs_main_intro This is a four exercises tutorial that will show you how to detect and prevent advanced malware, anyway I was moving along with the tutorial step by step and this statement caught my attention: Any process activities with a command line command length that is more than four times the average and standard deviation command line command lengths for each host is an outlier My question is why? is this a standard formula? an axiom? where did this come from? Here is the query that was used in this tutorial: sourcetype=xmlwineventlog:microsoft-windows-sysmon/operational EventCode=1 | eval cmdlen=len(CommandLine) | eventstats avg(cmdlen) as avg, stdev(cmdlen) as stdev by host | stats max(cmdlen) as maxlen, values(avg) as avgperhost, values(stdev) as stdevperhost by host, CommandLine | eval threshold = 4 * ( stdevperhost + avgperhost ) | where maxlen > threshold Here you can see it in the second eval command (in the line before the last). Thanks in advance. ... View more