Reading the diagram

Each layer answers a question the layer above can’t:

• iForest catches the first-pass per-flow weirdness you’d otherwise miss entirely (encrypted threats, novel tooling, low-frequency C2).
• HBOS turns that weirdness into per-host context — “this happened repeatedly for asset X” — and additionally catches gradual host degradation (network reliability) for free.
• OCCAM turns that context into a security narrative mapped to the MITRE ATT&CK matrix — “X is showing exfiltration-tactic behavior” — so analysts can triage by attacker intent, not by mystery score.
• OCCAM turns the narrative into a predictive alert by recognizing multi-stage attack paths — “X is mid-attack-path; investigate now” — and suppresses isolated tokens that don’t match any known sequence.

Skipping a layer leaves a gap:

What each one is

iForest — Isolation Forest

An unsupervised ML algorithm that builds many random trees that partition the feature space; anomalies are easier to “isolate” and produce shorter average path lengths in the trees.

• Pre-trained model — Rockfish ships baseline iForest models trained on representative traffic, and supports retraining against your own data.
• Strengths: handles high-dimensional input, no distribution assumptions, works on encrypted traffic where signatures don’t.
• Weaknesses: opaque (“why is this anomalous?”), needs periodic retraining as your network evolves.
• In the report: the Anomalies page surfaces top per-flow scores.

HBOS — Histogram-Based Outlier Score

A 2012 statistical anomaly score (Goldstein, Dengel). Per-feature histograms give the probability of seeing each value; the outlier score is the sum of −log P(feature_i) across features. High score = the combination of feature values is rare for this asset.

Rockfish runs HBOS-style baselines online using Welford’s algorithm so each asset has its own per-feature mean / variance estimate updated incrementally.

• Strengths: fast, online (no training data needed), interpretable per-feature, runs cheaply on every asset every 15 minutes.
• Weaknesses: assumes feature independence; less powerful than tree-based methods on highly correlated features.
• In the report: the Reliability page surfaces drift events and SLA breaches; HBOS also feeds the OCCAM classifier.

OCCAM — Behavioral tokenizer

Naming caveat: Rockfish OCCAM is not the OCCAM-rules format from sigmahq.io. They share a name but are unrelated. Rockfish OCCAM is a behavioral tokenizer; the public OCCAM is a YAML detection-rule grammar.

Every 15 minutes, for each asset, OCCAM aggregates window stats and emits tokens — short labels representing observed behavior categories (e.g. encrypted-ratio-high, slow-handshake, outbound-spike, unusual-port-mix). Each token carries:

• A surprisal score in bits — how rare this token is for this asset, computed via HBOS on the underlying features.

• An ATT&CK tactic mapping — initial access, execution, lateral movement, exfiltration, etc. — so the token is security-meaningful.

• Strengths: translates raw statistics into a vocabulary an analyst recognizes; per-asset baselining makes “rare for this host” the standard.

• Weaknesses: single-window view; can’t see “lead-up” patterns by itself.

• In the report: the OCCAM page surfaces tokens, dispositions, and the per-tactic breakdown.

OCCAM — Sequence predictor

Named for Occam’s razor: when multiple attack paths could explain the observed token sequence, pick the simplest. OCCAM is a Hidden Markov Model trained on historical token sequences leading up to confirmed incidents. It runs the Viterbi algorithm over the live OCCAM token stream to score how strongly the recent sequence resembles a known attack path.

Output is a per-token disposition:

• Strengths: forecasts attacks while they’re still in progress; cuts false positives via sequence context; explainable Viterbi paths.
• Weaknesses: depends on OCCAM tokens flowing; HMM trained on labeled attack paths.
• In the report: the Occam page surfaces dispositions, Viterbi paths, and pre-intrusion alerts.

Concrete example — the same incident through four lenses

A workstation slowly exfiltrating encrypted data over hours:

Each layer answers a question the layer above couldn’t:

When to look at each

License tier

The Anomaly lens (iForest / HBOS) and the Behavioral lens (OCCAM HMM sequence predictor) are Professional-tier features — both gate at Professional+ and on the corresponding parquet datasets being present. The detection swimlane + topology graph that overlay these lenses are Enterprise-tier. See License Tiers for the full feature matrix.