Adaptive Baselines

Flarehawk does not use fixed thresholds. Instead, it builds a statistical baseline for every metric it tracks, separately for each domain in your account. These baselines capture what “normal” looks like for your specific traffic—including how much it typically varies—and detection thresholds are derived from that learned normal. As your traffic evolves, the baselines evolve with it. This approach means Flarehawk alerts you to genuine anomalies rather than routine fluctuations, even as your application grows or changes.

​

How baselines are built

Flarehawk continuously maintains a running mean and variance for each metric in real time — there is no batch job that recalculates baselines on a schedule. Detection thresholds are derived from these statistics and adapt as your traffic changes, so the effective threshold in requests-per-minute (or error ratio, or bytes-per-second) rises and falls with your traffic. Some metrics use a smoothing approach that gives more weight to recent measurements, making baselines better suited for signals like error ratio where you want recovery to happen quickly after a transient incident.

​

Seasonal patterns

Traffic is not uniform throughout the day or the week. Flarehawk’s baselines account for two types of seasonality: Hour-of-day: The analysis worker tracks separate baseline statistics for each hour of the day. Traffic at 3 AM is not compared to traffic at 3 PM—each hour has its own learned mean and variance. This prevents overnight quiet periods from producing false positives when morning traffic picks up. Day-of-week: Similarly, weekend traffic patterns for most applications differ from weekday patterns. Flarehawk maintains per-day-of-week statistics so that a busy Saturday does not trigger an alert against a baseline built from weekday traffic. For the geographic anomaly rule, a full 14-day calibration period is used to capture both weekday and weekend patterns before full detection sensitivity is reached.

​

New domain calibration

When you add a new domain to Flarehawk, statistical rules enter a 7-day calibration period. During this time, the rules collect baseline data but apply relaxed sensitivity—alerts may fire at higher thresholds than normal to prevent spurious notifications while the baseline is still forming. After 7 days (and a minimum sample count), the calibration period ends and full detection sensitivity applies. The dashboard displays the calibration status for each domain in Settings → Detection. ML rules on Complete tier domains follow a longer 14-day calibration window, because the models require more data to establish reliable baselines.

​

False positive feedback

When you mark an alert as a false positive in the dashboard, Flarehawk uses that signal to adjust future detection for the same rule on the same domain. Specifically:

• The baseline mean and variance for the relevant metric are nudged upward, raising the effective threshold.
• The adjustment is weighted—a single false positive marking has a moderate effect; repeated false positive markings on the same rule have a stronger cumulative effect.
• True positive alerts are not penalized. The adjustment only applies when you explicitly mark an alert as a false positive.

This feedback loop is intentional and reversible. If you mark alerts as false positives too aggressively, some real threats may be missed. Flarehawk caps the maximum threshold increase to prevent baselines from drifting so high that detection becomes ineffective.

​

Viewing current baselines

You can inspect the current baseline values for any domain and rule in the Flarehawk dashboard.

​

When traffic patterns change suddenly

If your traffic changes abruptly—a product launch drives a 10x traffic increase, a migration shifts your path structure, or you turn on a CDN that changes your geographic distribution—the baseline will lag behind for a period. This can cause two types of behavior:

• Elevated false positives: Because the old baseline is now lower than your new normal, statistical rules may fire frequently until the baseline catches up.
• Reduced sensitivity: In rare cases where traffic drops dramatically (a maintenance window, for example), the baseline may temporarily set thresholds too low for the reduced traffic level.

The adaptive algorithm adjusts over hours to days depending on how large the change is and how much new data has arrived. For planned large changes, you can proactively reset the baseline for a specific rule or all rules on a domain from Settings → Detection → Reset Baselines. This restarts the 7-day calibration period and suppresses alerts until a new baseline is established.