Approximate Distinct Count Of

Find The: Approximate Distinct Count Of

approx_distinct_count_of

An approximate count of the unique values of one or more attributes over the given time period. Unlike Distinct Count Of, this Feature does not require an Identifier and can be applied to a much wider range of use cases.

For example:

• The number of times this user agent or OS has been seen in the last 2 weeks.
• The number of unique values of an attribute that is neither an Identifier nor a Subject.

Configuration

• Feature Name: The "dictionary" name under which the feature value will be stored and referenced by in rules.
• Attributes: Selects which attribute(s) to measure the unique value or combination of. Any attribute may be used; unlike Distinct Count Of this is not restricted to Identifier or Subject attributes.
• Expression: A Query-Language expression to count the unique results of, used instead of Attributes.

Optional Configuration

• Default Value: A value that can be assigned to the feature if the attributes to calculate the features are not present.
• Scope: Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
• Condition: A Query-Language filter that can be used to refine Features for specific use cases.
• Time Window: Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week. Default is all ; no time window

Use Case 1

Count the unique User Agents seen over the last 2 weeks.

Using the Feature in Rules and Investigations

Watch for a jump in the number of distinct User Agents on the node, the signature of a header-randomising bot campaign.

feature('cntx_os_usragn_2wk') >= 5000

Implementing In The Feature Editor

  - name: cntx_os_usragn_2wk
    default_value: 0
    time_window:
      weeks: 2
    find_the:
      approx_distinct_count_of:
        attributes:
          - profiling.device.user_agent
        for_events:
          event_type: all
    with_scope: same_node_instance