Update the baseline, or hide an incident?

Course · Part 3 · Part 3 exercises · Notebook · Example bank

Self-study after Part 3 · slide 56 · optional comparison. The lecture explains drift on its timeline. The normal workload can change, and an unreviewed update can absorb malicious behaviour into the reference. See both mechanisms on a time-ordered plot.

Teaching steps: predict, do, observe, explain

1. Choose Approved workload move and Original approved office history. Read the time and MB/min axes; predict false alarms.

2. Keep the observed window fixed; choose Reviewed post-migration history. Explain the change in false alarms, not just the quieter plot.

3. Keep that reviewed baseline; choose Same workload + two theft events. Identify the two high-volume events and alert rings.

4. Keep the incident fixed; accept it as normal. Explain the missed thefts and who should authorise an independent reference update.

The in-demo step controls move between instructions. They never perform the next experiment for you. Record one observation before moving on.

Predict, try, explain

1. Select Approved workload move, keeping the Original approved office history. All eight authored benign events now look unusual. Explain which assumption changed.

2. Keep the event window fixed and select Reviewed post-migration history. Compare false alarms. Now select Same workload + two theft events while keeping that reviewed baseline.

3. Keep the incident window fixed. Choose Accept the incident window as normal. Inspect missed thefts. Discuss who can approve a new reference and which evidence should remain independent.

Record: I changed ___. I predicted ___. I observed ___. This does not establish ___.

More experiments

Compare each observed window against each baseline. Explain why fewer alarms may mean either a relevant new reference or a hidden incident. Propose a reviewed, versioned update and a rollback observation.

What this example establishes

The reviewed migration baseline removes the eight migration false alarms and flags both high-volume thefts. Accepting the incident window itself as normal misses both thefts. Real monitoring needs representative data and reliable outcomes, not simply a quiet dashboard.

Explain it to your partner

Question: Alerts disappear after accepting the incident window as normal. What would distinguish adaptation from concealment?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: A reviewed baseline needs independent outcome and label evidence. A quieter chart alone does not establish a safer detector.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.