> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/tracer.md).

# Tracer

With Enginsight's Tracer feature, you can set up Machine Learning (ML)-based time series analyses for your streams. These AI models can automatically detect deviations from a calculated baseline that may indicate an attack.

***

## Requirements

**Training period**

* **At least seven days of data** are required so that an AI model can identify time-based patterns and detect anomalies based on them. We recommend a data basis of at least four weeks for reliable anomaly detection.
* If the data horizon for your AI models is still **shown as insufficient** after several days, this may be due to a log-entry retention period (time to live; TTL) in the Enginsight component Loggernaut that is set too short. In this case, you must extend the TTL accordingly.

{% hint style="success" icon="lightbulb" %}
For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
{% endhint %}

***

## Important Notes

* If the AI model is deleted, all values previously measured and used by the AI model to calculate the baseline and detect anomalies are also deleted. Training a new AI model will again take at least seven days to establish a reliable data basis for the calculation.

***

## Tracer: Menu Structure

Under **SIEM** → **Tracer**, you can find various options for configuring ML-based time series analyses for your streams. This helps you detect deviations from the baseline that may indicate an attack.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Tracer** menu item to expand or collapse the corresponding submenu.

The following submenu items are available:

{% columns %}
{% column width="33.33333333333333%" %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FTCrIEcHa6ANal5MciVEp%2FEnginsight-EN-Menu-SIEM-Tracer.jpg?alt=media&amp;token=091c19be-a972-4b57-84da-e31a0b3740de" alt=""><figcaption></figcaption></figure>
{% endcolumn %}

{% column width="66.66666666666667%" %}

* [Models](/docs/manual/english/platform-usage/siem/tracer/models.md)
  {% endcolumn %}
  {% endcolumns %}

<i class="fa-grip-dots-vertical">:grip-dots-vertical:</i> Click and hold the **Tracer** menu item to move it, including all submenu items, within the menu tree using drag and drop.

***

## Further Resources

**Knowledge Base**

* [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
* [The Tracer in Enginsight shows a certificate error and does not connect. What can I do?](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/the-tracer-in-enginsight-shows-a-certificate-error-and-does-not-connect-what-can-i-do)

***