Refer to the exhibit.

The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is:

AVG(Firewall Session)represents the current firewall session rate.

STAT_AVG(AVG(Firewall Session);112)represents the historical average over a 112-time unit window.

STAT_STDDEV(AVG(Firewall Session);112)represents the historical standard deviation over the same period.

AZ-score ≥ 3indicates that the current firewall session rate issignificantly higherthan the historical average (3 standard deviations above the mean), signaling ananomaly.