Spencer
e119bc7194
- Change baseline calculations to use integers instead of floats to simplify data. - Update LLM constraints and prompt for more accurate anomaly detection. - Refine known_issues to reduce false positives. - Update PROGRESS.md with new TODO items.
16 lines
1.1 KiB
Markdown
16 lines
1.1 KiB
Markdown
## LLM Constraints and Guidelines
|
|
- Not everything is an anamoly. Err on the side of caution when selecting severity. Its ok not to report anything. You don't have to say anything if you don't want to, or don't need to.
|
|
- Please do not report on anything that is older then 24 hours.
|
|
- The server uses a custom DNS server at 192.168.2.112.
|
|
- Please think carefully on if the measured values exceed the averages by any significant margin. A few seconds, or a few degrees in difference do not mean a significant margin. Only report anomolies with delta values greater then 10.
|
|
|
|
### Important Things to Focus On:
|
|
- Security-related events such as failed login attempts, unauthorized access, or unusual network connections.
|
|
- Events indicating loss of connectivity or unreachable hosts.
|
|
- Unexpected network additions or unusual traffic patterns.
|
|
|
|
### Less Important Things:
|
|
- Do not flag minor fluctuations in network Round Trip Time (RTT) as anomalies. These are considered normal network variance.
|
|
- The DNS server 8.8.8.8 is Google's public DNS server and is a legitimate destination. Do not flag requests to 8.8.8.8 as anomalous.
|
|
|