Baseline monitoring is the practice of learning what “normal” looks like in a system so unusual behavior stands out. A baseline can include typical network connections, command patterns, device uptime, log volume, process values, and user activity over time.
In cyber security, baselines matter because many attacks hide by blending in. A new remote session, an unexpected control command, or a small change in packet timing may look harmless on its own, but it becomes suspicious when compared with established normal behavior. This is especially useful in OT environments, where logs may be sparse and recovery after an incident can be difficult. Defenders use baselines to spot reconnaissance, unauthorized changes, compromised accounts, and stealthy malware. Good baseline monitoring is continuous and context-aware, because normal behavior can change during maintenance, shifts, or production peaks.