> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/tracer/models.md).

# Models

Models are responsible for Machine Learning (ML)-based monitoring and time series analysis of [streams](/docs/manual/english/platform-usage/siem/advanced-settings/streams.md).

During the training phase, the model determines what is considered the baseline for the monitored metric over a specific period of time.

Based on this data, once the training period is complete, the ML model can automatically detect deviations from the baseline that might indicate a potential attack.

{% hint style="warning" %}
**Please note**: At least seven days of data are required for an ML model to identify temporal patterns and detect anomalies based on them. We recommend a training period of at least four weeks to establish a meaningful data basis.
{% endhint %}

{% hint style="danger" %}
**Please note**: If the data horizon for your ML models is still shown as insufficient (**Insufficient**) after several days, the configured retention period (Time to Live; TTL) for log entries in the Enginsight component Loggernaut might be too short. In this case, you must extend the TTL accordingly.
{% endhint %}

{% hint style="success" icon="lightbulb" %}
For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
{% endhint %}

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Tracer** → **Models** to show a list of all ML models. If you have not created a model yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FxYgcqe3yWieHN5VvXa8z%2Fenginsight-screenshot-siem-tracers-models.jpg?alt=media&amp;token=82826d92-b43e-4731-8937-5fd36aec8f3c" alt=""><figcaption></figcaption></figure>

The [model overview](#models-overview) provides information such as:

* whether a model has sufficient training data to produce valid results.
* which stream is monitored and analyzed by the model.
* which field or metric is monitored and analyzed.

You can also [enable or disable ML models](#additional-actions-for-list-items).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Filtering the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available Filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>Enabled</td><td>Boolean</td><td><p>Filter by whether a model is enabled.<br><br>The following values are available:</p><ul><li><strong>True</strong>: The model is actively searching for anomalies.</li><li><strong>False</strong>: The model is disabled.</li></ul></td></tr><tr><td>Field Name</td><td>String</td><td>Filter by a specific metric that is monitored and analyzed over time, or exclude it from the results. All available metrics are displayed.</td></tr><tr><td>Status</td><td>String</td><td>Filter by a specific status of the model's training phase, or exclude it from the results. All available statuses are displayed.</td></tr><tr><td>Stream</td><td>String</td><td>Filter by a specific stream that is monitored and analyzed, or exclude it from the results. All available streams are displayed.</td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the respective item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list items is now shown next to the search field.

The <i class="fa-slider">:slider:</i> **Actions** menu also appears in the upper-right corner. Click it to expand the respective submenu. The following actions are available:

<table><thead><tr><th width="149.84375">Action</th><th>Description</th></tr></thead><tbody><tr><td>Enable</td><td><p><i class="fa-eye">:eye:</i> This action is available only if all selected models are inactive.</p><p>Enable all inactive models.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Please note</strong>: At least seven days of data are required for an AI model to identify temporal patterns and detect anomalies based on them. We recommend a data set covering at least four weeks for reliable anomaly detection.</p></div></td></tr><tr><td>Disable</td><td><i class="fa-eye">:eye:</i> This action is available only if all selected models are active.<br><br>Disable all active models.</td></tr><tr><td>Delete</td><td><p>Delete all selected models. Confirm the message that appears by clicking <strong>Delete</strong>.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: Deleted models cannot be recovered.</p></div></td></tr></tbody></table>

***

## Models: Overview

The model overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FCzh82KvTxiOQgHKTAsbt%2Fenginsight-screenshot-siem-tracers-models%20overview.jpg?alt=media&amp;token=e8493b54-d996-4471-a656-6d2c1987cb42" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.3125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the custom name of the model.</p><p></p><p>The date and time of creation and last edit are also shown.</p></td></tr><tr><td>Status</td><td><p>Shows the status of the model's training phase.<br></p><p>The following states are available:</p><ul><li><strong>Error</strong>: An error occurred during the training phase. Training has been stopped.</li><li><strong>Finished</strong>: The training phase is complete.</li><li><strong>Inactive</strong>: No training is taking place because the model is disabled.</li><li><strong>Insufficient</strong>: The training phase is still in progress because the data horizon is not yet sufficient.</li></ul><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: If the data horizon for your ML models is still shown as insufficient (<strong>Insufficient</strong>) after several days, the configured retention period (Time to Live; TTL) for log entries in the Enginsight component Loggernaut might be too short. In this case, you must extend the TTL accordingly.</p></div><div data-gb-custom-block data-tag="hint" data-style="success" data-icon="lightbulb" class="hint hint-success"><p>For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: <a href="https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs">How can I adjust the retention periods for my Enginsight logs?</a></p></div></td></tr><tr><td>Reference</td><td>Shows the name of the stream monitored and analyzed by the model.</td></tr><tr><td>Field Name</td><td>Shows the name of the field or metric that is monitored and analyzed over time.</td></tr><tr><td>Enabled</td><td>Shows whether the model is actively searching for anomalies or is disabled.<br><br>An enabled model is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:green;">:circle-check:</i>. Disabled models are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr></tbody></table>

***

## Model: Detail View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Name** column of a list item to navigate to the [detail view of the monitored metric in the corresponding stream](/docs/manual/english/platform-usage/siem/tracer/models/model-detail-view.md).

***

## Further Resources

**Knowledge Base**

* [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)

***