features

Documentation

Overview

Command features exports the numeric feature vectors the baseline detectors of §12.4 consume: Isolation Forest, Extended Isolation Forest, Half-Space Trees, and Robust Random Cut Forest, run by sidecar/baselines.py.

The baselines embody the standard formulation of §3: a fixed-length numeric vector per event, with no per-entity state. The encoding below is therefore deliberately the conventional one, not the framework's: categorical values are hashed to [0, 1) with a stable FNV-1a, time becomes hour-of-day and day-of-week fractions, and the schema is fixed at export time. Baselines are not part of the framework and are not held to R2 or R4 (§12.4); the export itself is still deterministic so the comparison is reproducible.

Sampling: streaming the full scored window through the Python baselines is not feasible for the tree ensembles, so the export carries a deterministic 1-in-N uniform sample (FNV-1a of the event digest, no RNG) plus every red-team event, each row flagged. Alert-budget thresholds are estimated from the uniform sample's score quantiles; recall at a budget is computed over the red-team rows, which are excluded from threshold estimation so their inclusion cannot bias it. The result JSON records both counts and the sampling rate.