Documentation Index

Fetch the complete documentation index at: https://docs.darwinium.com/llms.txt

Use this file to discover all available pages before exploring further.

Distance Between

  • Published on Jun 7, 2024
  • 1 minute(s) read
  • CG
 Prev Next

Calculates aggregate statistics of the distance between the location of multiple past events matching the criteria, sorted in chronological order. The location is determined by selecting an appropriate coordinate attribute and can be calculated in mile or kilometer units.

For example:

  • Determining the distance traveled by a user within 1 hour. Unusually high results can be indicitave of ATO attacks, Proxy/VPN or other suspicious activities.

Configuration

  • Feature Name
    The "dictionary" name under which the feature value will be stored.

  • Coordinate Attribute

    • Selects the coordinate attribute to calculate the distance between events.

  • For Events > With The Same

    • Only Identifier and Subject attributes can be used.
Note
  • At least one of the selected attributes must be an Identifier.
  • Into Features
    • Time Between can calculate multiple statistics from a single configuration and output them to the Feature Names given. Simply fill in the Feature Name for the required statistics, any that are not required can be left blank.
Note
  • There are multiple Feature Names generated, a Feature Name must be given to each of the required statistics.
Optional Configuration
  • Default Value
    A value that can be assigned to the feature if the attributes to calculate the features are not present.
  • Scope
    Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
  • For Events
    Provides a way of filtering past events based on their type.
  • Condition
    A Query-Language filter that can be used to refine Features for specific use cases.
  • In Units
    Can be used to change the feature value output from kilometers to miles.
  • Time Window
    Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week.
  • Starting ...
    Can be used to remove recent events from Feature calculation.

Use Case 1

Determining the distance traveled by a user within 1 hour. To do this we Sum the distance between all events over the last 1 hour (including the current event).

Using the Feature in Rules and Investigations View

outcome['CHAMPION'].features.general['login_dist_trav_1hr'] >= 1000.0

Implementing In The Feature Editor

image.png

image.png

image.png

  - name: login_dist_trav
    default_value: 0
    time_window:
      hours: 1
    starting: immediately
    find_the:
      distance_between:
        events:
          event_type: all
          include_current_event: true
          with_the_same:
            - identity['ACCOUNT'].login.login
        coordinate: profiling.tcp_connection['WEBRTC'].ipdb.coordinate
        in_units: kilometers
        into_features:
          sum: login_dist_trav_1hr
    with_scope: same_node_instance