> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/tracer/models.md).

# Models

Models are responsible for Machine Learning (ML)-based monitoring of hosts based on previously created [Tracers](/docs/manual/english/platform-usage/hosts/tracer/tracers.md).

For each Tracer, a corresponding ML model is created and trained for every assigned host. During the training phase, the model determines what is considered the normal value for the monitored metric over a specific period of time.

Based on this data, once the training period has been completed, the ML model can automatically detect deviations from the normal value that might indicate a potential attack.

{% hint style="warning" %}
**Please note**: At least seven days of data are required for an ML model to identify temporal patterns and detect anomalies based on them. We recommend a training period of at least four weeks to establish a meaningful data basis.
{% endhint %}

{% hint style="danger" %}
**Please note**: If the data horizon for your ML models is still shown as insufficient (**Insufficient**) after several days, the configured retention period (Time to Live; TTL) for log entries in the Enginsight component Loggernaut might be too short. In this case, you must extend the TTL accordingly.
{% endhint %}

{% hint style="success" icon="lightbulb" %}
For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
{% endhint %}

***

<i class="fa-compass">:compass:</i> Navigate to **Hosts** → **Tracer** → **Models** to show a list of all ML models per Tracer and host. If you have not created a Tracer to train a model yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FDYo58J3UkuAyJ0oreBj3%2Fenginsight-screenshot-hosts-tracer-models.jpg?alt=media&amp;token=12cc325e-ce3b-4e50-9636-f400bb801eaf" alt=""><figcaption></figcaption></figure>

The [model overview](#models-overview) provides information such as:

* which Tracer is used to create the model.
* which metric is monitored on which host.

You can also [enable or disable ML models](#additional-actions-for-list-items).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Filtering the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available Filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>Enabled</td><td>Boolean value</td><td><p>Filter by whether a model is enabled or not.<br><br>The following values are available:</p><ul><li><strong>True</strong>: The model actively searches for anomalies.</li><li><strong>False</strong>: The model is disabled.</li></ul></td></tr><tr><td>Field Name</td><td>String</td><td>Filter by a specific metric that is monitored and analyzed over time, or exclude it from the results. All available metrics are shown.</td></tr><tr><td>Reference</td><td>String</td><td>Filter by a specific host that is monitored and analyzed, or exclude it from the results. All available hosts are shown.</td></tr><tr><td>Status</td><td>String</td><td>Filter by a specific status of the model's training phase, or exclude it from the results. All available states are shown.</td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the respective item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list items is now shown next to the search field.

The <i class="fa-slider">:slider:</i> **Actions** menu also appears in the upper-right corner. Click it to expand the respective submenu. The following actions are available:

<table><thead><tr><th width="149.84375">Action</th><th>Description</th></tr></thead><tbody><tr><td>Enable</td><td><p><i class="fa-eye">:eye:</i> This action can only be clicked if only inactive models are selected.</p><p></p><p>Enable all inactive models.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Please note</strong>: At least seven days of data are required for an ML model to identify temporal patterns and detect anomalies based on them. We recommend a data basis of at least four weeks for reliable anomaly detection.</p></div></td></tr><tr><td>Disable</td><td><i class="fa-eye">:eye:</i> This action can only be clicked if only active models are selected.<br><br>Disable all active models.</td></tr></tbody></table>

***

## Models: Overview

The model overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FrXh1YHYf5EnKnjFYryZ5%2Fenginsight-screenshot-hosts-tracer-models%20overview.jpg?alt=media&amp;token=d0d020d6-ed27-412c-b85c-fa57d122b71a" alt=""><figcaption></figcaption></figure>

The following information is provided:

<table><thead><tr><th width="200.3125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the custom name of the Tracer on which the model is based.</p><p></p><p>The date and time of creation and last edit are also shown.</p></td></tr><tr><td>Status</td><td><p>Shows the status of the model's training phase.<br></p><p>The following states are available:</p><ul><li><strong>Error</strong>: An error occurred during the training phase. Training was stopped.</li><li><strong>Finished</strong>: The training phase has been completed.</li><li><strong>Inactive</strong>: No training is taking place because the model is disabled.</li><li><strong>Insufficient</strong>: The training phase is still running because the data horizon is not yet sufficient.</li></ul><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: If the data horizon for your ML models is still shown as insufficient (<strong>Insufficient</strong>) after several days, this might be due to the retention period (time to live; TTL) for log entries in the Enginsight component Loggernaut being set too short. In this case, you need to extend the TTL accordingly.</p></div><div data-gb-custom-block data-tag="hint" data-style="success" data-icon="lightbulb" class="hint hint-success"><p>For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: <a href="https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs">How can I adjust the retention periods for my Enginsight logs?</a></p></div></td></tr><tr><td>Reference</td><td>Shows the name of the host monitored and analyzed by the model.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a host to navigate to the respective <a href="/docs/manual/english/platform-usage/host-detail-view.md">host detail view</a>.</td></tr><tr><td>Field Name</td><td>Shows the name of the metric that is monitored and analyzed over time.</td></tr><tr><td>Enabled</td><td>Shows whether the model is actively searching for anomalies or whether it is disabled.<br><br>If the model is enabled, this is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:green;">:circle-check:</i>. Disabled models are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr></tbody></table>

***

## Model: Detail View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Name** column of a list item to navigate to the [detail view of the monitored metric on the corresponding host](/docs/manual/english/platform-usage/hosts/tracer/models/model-detail-view.md).

***

## Further Resources

**Knowledge Base**

* [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)

***