Improving Long Tail Analysis Using Neighborhood Keeper
Summary: Dragos published the third post in its Neighborhood Keeper series, focused on long tail analysis - identifying low-occurrence events that fall outside the core of routine network behavior to surface activity worth investigating. The post describes using the Neighborhood Keeper Portal's "Least Common Threat Analytic" view and "Trends" tab, with a "Compare" button to pivot from a defined timeframe to a longer trends view, to add context to those events.
What you should know: The method depends on a baseline of what normal looks like for a given network, built through purposeful observation over time - and the low-occurrence events it surfaces are often misconfigurations or maintenance, not attacks, so the value rests on how well that baseline is established before an anomaly appears.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026