> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-detection-time-intervals.md). # Analytics detection time intervals The Cortex Cloud Analytics Engine retrieves logs from the Cortex Cloud tenant to create a baseline so that it can generate issues when abnormal activity occurs. This analysis is highly sophisticated and performed on more than a thousand dimensions of data. Internally, Cortex Cloud organizes its analytics activity into algorithms called detectors. Each detector is responsible for generating an issue when suspicious behavior is detected. To generate issues, each detector compares the recent past behavior to the expected baseline by examining the data found in your logs. A certain amount of log file time is required to establish a baseline and then a certain amount of recent log file time is required to identify what is currently happening in your environment. There are several meaningful time intervals for Cortex Cloud Analytics detectors: | Time interval | Description | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Activation period |

The shortest amount of log file time before the app can generate an issue. This is typically the period between the time a detector first starts running and the time you see an issue. However, in some cases, detectors pause after an upgrade as they enter a new activation period.

Most but not all detectors start running after the activation period ends. The activation period provides the detector enough data to establish a baseline, which in turn helps to avoid false positives.

The activation period is also called the profiling or waiting period and is informally referred to as soak time.

| | Test period | The amount of logging time that a detector uses to determine if unusual activity is occurring on your network. The detector compares test period data to the baseline created during the training period, and uses that comparison to identify abnormal behavior. | | Training period |

The amount of logging time that the detector requires to establish a baseline, and to identify the behavioral limits beyond which an issue is generated. Because your network is not static in terms of its topology or usage, detectors are constantly updating the baselines that they require for their analytics. For this update process, the training period is how far back in time the detector goes to update and tune the baseline.

This period is also referred to as the baseline period.

Note

When establishing a baseline, detectors compute limits beyond which network activity will require an issue. In some cases, detectors do not compute baseline limits; instead they are predetermined by Cortex Cloud engineers. The engineers determine the values used for predetermined limits using statistical analysis of malicious activity recorded worldwide. The engineers routinely perform this statistical analysis and update the predetermined limits as needed with each release of Cortex Cloud.

| | Deduplication period | The amount of time in which additional issues for the same activity or behavior are suppressed before Cortex Cloud generates another Analytics issue. | These time periods are different for every Cortex Cloud Analytics detector. The actual amount of logging data (measured in time) required to generate any given Cortex Cloud Analytics issue is specified in the Cortex XDR Analytics Alert Reference Guide.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-detection-time-intervals.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.