iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Prelert’s Anomaly Detective V4, announced on September 21, 2015, added Insights: a way to group time-linked anomalies that shared entities such as users, IP addresses or domains, helping security and operations teams investigate related activity instead of reviewing isolated log events.
What Prelert announced
BetaNews reported that Anomaly Detective V4 used machine-learning analysis to identify unusual or potentially suspicious behavior in log data. Its new Insights capability organized related anomalies into a broader investigative view. The announcement targeted both IT security teams looking for attack activity and IT operations teams diagnosing failures or other root causes.
This was a product announcement, not an independent evaluation. It described intended capabilities and workflows, but did not establish detection accuracy, reduced response times or verified operational outcomes.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How Insights connected anomalies
Shared entities created the link
An Insight grouped anomalies across time when they had one or more entities in common. The entities described in the announcement included:
#1 Best Overall
- Users
- IP addresses
- Domains
That relationship gave an analyst a way to examine events as part of a connected sequence. For example, separate anomalies involving the same user and IP address could be reviewed together rather than treated as unrelated alerts.
Anomaly Timeline showed sequence
An Anomaly Timeline displayed the temporal relationship among anomalies within an Insight. The purpose was to make the order and progression of related events easier to inspect, including patterns that might indicate an attack developing over time or an operational incident spreading through an environment.
Rank #2
Preconfigured and analyst-defined Insights
| Definition type | What the announcement described | Potential use |
|---|---|---|
| Preconfigured | Definitions supplied for automatic Insight creation around activities such as cyber kill-chain progressions. | Surface commonly recognized sequences without requiring an analyst to design each rule first. |
| Organization-defined | Analysts could create definitions using factors specific to their own environment, then save, label, comment on and reuse them. | Adapt investigations to local systems, identities, network behavior and operational practices. |
The distinction mattered because a general security pattern and an organization’s own normal-versus-abnormal behavior are not always the same. Preconfigured definitions offered a starting point; custom definitions were intended to capture local context.
Use in security investigations
For security teams, the announced workflow was to inspect an unusual event, examine other Insights with a shared influence, and use the relationships to look for an attack pattern. The reference to cyber kill-chain progressions suggests that the feature was designed to help connect stages of activity rather than display a single suspicious record in isolation.
Prelert’s then-CEO Mark Jaffe described the problem this way: IT security and operations teams were “drowning in log data” and could not piece the story together on their own. He also said, “With our machine learning capabilities, Prelert enables organizations to pinpoint issues that really matter.” Those statements are company positioning from the 2015 announcement, not measured evidence of performance.
Use in IT operations troubleshooting
The same entity-and-time model was presented for operational diagnosis. Anomalies associated with a common user, address, domain or other environmental factor could be examined together to search for a shared cause. In that framing, Insights was not limited to intrusion detection; it was also a method for moving from scattered log abnormalities toward a possible root-cause investigation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the announcement does not establish
- It does not provide a benchmark, named statistic or independently tested accuracy result.
- It does not show how many logs, entities or anomalies a deployment could process.
- It does not establish that every grouped relationship represented a genuine attack or root cause; shared entities can also occur in routine activity.
- It does not confirm current availability, support, ownership, pricing or a successor product.
Accordingly, Anomaly Detective V4 should be understood as a historical Prelert product announcement from September 2015. The evidence supports what Insights was intended to do, not whether the product remains obtainable or how well it performed in production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
