How long does Primary Response take to profile application behavior?
The adaptation period is autonomously determined by the Primary Response Agent, depending on the type and complexity of the application it is monitoring. The agent monitors the quantity of new system call code paths, which it observes over time, and lowers its adaptation sensitivity threshold accordingly. Because server-based applications typically perform repetitive tasks, Primary Response can build a profile of normal behavior in several hours. In the case of applications exhibiting more erratic behavior, the agent may profile the application for a few days before it has completely learned the normal application behavior.
