Patent ID: 11870795
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. The one or more non-transitory computer-readable media of claim 11, further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform the steps of:
maintaining a plurality of behavior profiles including the first behavior profile, wherein each behavior profile included in the plurality of behavior profiles corresponds to a different client device in a plurality of client devices that includes the first client device;
grouping, based on a plurality of baseline behaviors associated with the plurality of behavior profiles, a group of accounts associated with the plurality of behavior profiles into a cluster having a cluster baseline behavior;
comparing the cluster baseline behavior to the second account associated with the second set of raw machine data; and
detecting a second anomaly in the second set of raw machine data when a difference between the cluster baseline behavior and the second account exceeds a second threshold.