A compact model that records how often each categorical value appears for an entity, such as process names or destination domains. It supports first-sighting and familiarity-style detections by showing whether a value is common, rare, or entirely unseen for that specific entity.
Expanded Definition
A frequency table is a compact entity-level record of categorical observations, usually keyed by a subject such as a host, user, process, service, or destination. In security analysis, it answers a narrow question: has this value been seen before for this same entity, and if so, how often?
Its value lies in context. A domain name, parent process, or command string can look ordinary in isolation, but a per-entity frequency table can show whether it is a first sighting, a rare event, or a familiar pattern. That makes it useful for detection logic that depends on novelty rather than absolute maliciousness. It is not a full profile, a statistical model of intent, or a replacement for behavioural analytics; it is a lightweight memory structure that supports those analyses.
A common boundary misunderstanding is to treat low frequency as suspicious by itself. In practice, rarity only matters relative to the entity, the time window, and the data quality behind the table. A strong implementation keeps the scope explicit so analysts can interpret whether the table reflects recent behaviour, long-term history, or a rolling observation window.
Examples and Use Cases
Frequency tables appear in detection pipelines where familiarity matters more than raw prevalence. They often support rules and scoring rather than acting as a standalone control. For a specialist identity reference on entity-linked abuse patterns, see OWASP Non-Human Identity Top 10.
- A workstation frequency table tracks destination domains so a first-time connection to an external host can receive additional scrutiny.
- A process table records parent-child process pairs to highlight a rare execution chain on a server that normally runs a stable workload.
- An email or collaboration platform table counts sender or attachment patterns to flag unusual activity for a specific account.
- A cloud workload table tracks API endpoints or service-to-service callers so new access paths stand out during investigation.
- An analyst can compare current activity against the table to decide whether a value is merely uncommon or genuinely outside the entity’s normal behaviour.
The trade-off is simplicity versus expressiveness. Frequency tables are cheap to maintain and easy to explain, but they can miss context such as seasonality, legitimate change, or coordinated low-and-slow abuse.
Security Implications
When frequency tables are poorly scoped or stale, they can mislead detection logic. A value may appear rare only because the observation window is too short, the entity has little history, or the underlying telemetry is incomplete. That creates false positives, noisy triage, and blind spots where genuinely unusual behaviour is normal for one class of asset but not another.
They also fail when defenders assume rarity equals maliciousness. Attackers often benefit from being only slightly outside the norm rather than dramatically anomalous. A novel destination, process, or token use may be enough to escape broad allowlists if the table is not paired with context such as asset criticality, time-of-day patterns, or relationship graphs.
Practitioner observation: the most common implementation weakness is not the table itself but the entity boundary around it. If the subject is too broad, uncommon actions disappear into the average; if it is too narrow, every legitimate change becomes an alert.
Domain and Governance Relevance
Frequency tables matter wherever defenders need per-entity familiarity to support detection, review, or trust decisions. In identity-heavy environments, they help separate ordinary access patterns from unusual activity across accounts, service principals, workloads, and tools. That is especially relevant where non-human identities act at scale, because a single service account can generate consistent but sensitive patterns that should not be judged against human user baselines.
For NHI governance, the key question is not simply how often something occurs, but whether the entity has a stable, approved operating profile. A frequency table can support that judgment, but it cannot define ownership, authorization scope, or lifecycle control on its own. Those remain governance questions that need inventory, accountability, and review.
Used well, the table gives investigators a fast way to spot first sightings and relationship drift. Used badly, it becomes a false comfort mechanism that records novelty without telling you whether the novelty is expected, approved, or dangerous.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1083 — File and Directory Discovery | Rare discovery patterns can surface when this technique first appears on a host. |
| Recommendation — Map uncommon discovery bursts to T1083 and investigate first-time discovery activity. | ||
| CIS Controls v8 | 8 — Audit Log Management | Frequency tables depend on consistent telemetry to make rarity meaningful. |
| Recommendation — Use Control 8 to ensure logs are retained and normalised for frequency analysis. | ||
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Entity-level frequency tracking is a continuous monitoring capability. |
| Recommendation — Apply DE.CM to monitor entity behaviour and review rare events against baseline. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Secrets Exposure and Misuse | NHI workloads often need per-entity familiarity tracking for abnormal usage. |
| Recommendation — Track NHI activity frequency to surface first-time or rare secret and token use. | ||
