// tool reference · Monitoring & Detection
Suspicious Pattern Analyzer Free + Pro
AI-assisted scoring of logs and payloads for suspicious, signature-less patterns.
Open Suspicious Pattern Analyzer →
What it does
Behavioural anomaly detection for activity that has no signature yet. Instead of matching known-bad, it looks for shapes that are wrong: timing regularity, entropy, sequence and volume anomalies.
When to use it
- Something feels wrong but nothing matched a rule.
- You suspect beaconing, living-off-the-land activity, or a novel pattern.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| sample | textarea | required | The activity sample — logs, process lines, connection records. |
| source_type | select | optional | What the sample is, to guide parsing. |
| use_ai | checkbox | optional | Add AI interpretation over the deterministic findings. |
| authorized | checkbox | required | Confirm you are authorised to analyse this data. |
What you get back
Ranked anomalies with the statistical reason each was flagged.
Worked example
Input
2026-07-17T10:00:03Z host-a -> 198.51.100.7:443 bytes=1120 2026-07-17T10:05:03Z host-a -> 198.51.100.7:443 bytes=1118 2026-07-17T10:10:04Z host-a -> 198.51.100.7:443 bytes=1121 2026-07-17T10:15:03Z host-a -> 198.51.100.7:443 bytes=1119
Output (abridged)
HIGH Beaconing -- host-a -> 198.51.100.7
Interval: 300.3s +/- 0.5s (jitter 0.17%)
Payload: 1,119 bytes +/- 1.5
Human traffic is irregular. Machine traffic is not. 0.17% jitter
over a 5-minute cycle with near-constant payload is a scheduled
check-in, not browsing. TLS on 443 hides content, not rhythm.
-> Identify the process owning the socket on host-a.
-> Check 198.51.100.7 reputation and registration age.
-> This is the shape of C2. Treat as suspected compromise.
How it works
Deterministic statistics first (entropy, interval regularity, frequency); optional AI narrative second.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
It finds statistical outliers, not attribution. A backup agent and a beacon look identical to statistics -- you supply the context that separates them. Expect false positives from monitoring agents and cron.
Privacy
Analysed in memory. Not persisted.
Standards
MITRE ATT&CKNIST CSF (DE.CM)