A 60-day time series of SIEMBIOT security telemetry was analysed to forecast expected event-ingestion volumes and evaluate recurring daily and weekly activity patterns.
Historical security telemetry collected through SIEMBIOT was used to evaluate whether recurring time-series patterns could provide a reliable estimate of future event-ingestion volumes.
The objective was not to predict a specific cyberattack. The research focused on forecasting the expected behaviour of the monitored telemetry itself and establishing a measurable future baseline against which subsequently observed activity can be compared.
Dataset and Telemetry Source
Source: SIEMBIOT security telemetry
Metric: Number of ingested security events
Aggregation interval: 1 hour
Observation period: 60 days
Historical observations: 1,440 hourly intervals
Observation window: Jun 20, 2026 - Aug 19, 2026, ending at 14:00 local platform time
Forecast horizon: Next 24 hours
The analysed dataset contained one observation for every hourly interval during the 60-day period.
No missing hourly intervals, duplicate timestamps or zero-event intervals were identified.
The observed telemetry volume ranged from 62,516 to 1,934,749 events per hour, with an overall average of approximately 900,542 events per hour.
Data Preparation and Operational Context
Event counts were maintained on a continuous hourly time grid before forecasting.
An important distinction was made between genuine low event activity and periods in which telemetry volume was affected by operational activity.
A significant reduction in event ingestion observed on Jul 22, 2026 corresponded to a known planned maintenance event.
Because this reduction did not represent normal telemetry behaviour, the maintenance period was identified during preprocessing and was not treated as a representative low-volume pattern for model fitting and evaluation.
This distinction is important because maintenance events, ingestion failures, collector interruptions and other known operational conditions can otherwise influence the expected baseline learned from historical telemetry.
Time-Series Pattern
The historical series showed clear recurring temporal behaviour.
Event ingestion was generally higher during active working periods and lower during overnight and weekend periods.
The strongest repeatable characteristic was a weekly seasonal pattern.
Activity observed at a specific hour showed substantial similarity with activity recorded at the same hour one week earlier. The correlation between the time series and its 168-hour lag was approximately 0.78.
This indicated that weekly seasonality was an important forecasting signal within the analysed SIEMBIOT telemetry.
Forecasting Methodology
Multiple forecasting approaches were evaluated rather than selecting a model in advance.
The following models were compared:
Seasonal Naive 24h - predicts an hour using the value observed at the same hour on the previous day;
Seasonal Naive 168h -predicts an hour using the value observed at the same hour one week earlier;
Holt-Winters 24h - exponential smoothing using daily seasonality;
Holt-Winters 168h - exponential smoothing using weekly seasonality.
The Holt-Winters models were included to determine whether a more complex model combining level, trend and seasonality would improve forecasting accuracy over simple historical seasonal baselines.
Because the dataset contains approximately 8.5 complete weekly cycles, the 168-hour Holt-Winters model was considered exploratory and its results were evaluated against the simpler weekly seasonal baseline.
Forecast Evaluation
Forecast accuracy was assessed using rolling-origin validation.
Seven consecutive 24-hour forecast windows were evaluated. At each forecasting point, only historical telemetry available before the beginning of that window was used.
This reproduces the operational forecasting scenario more accurately than randomly splitting a time series into training and testing observations.
Average results across the evaluated forecast windows were:
ModelMAERMSEMAPEWAPESeasonal Naive 168h67,45594,7997.18%7.69%Holt-Winters 168h80,10090,8929.46%8.96%Seasonal Naive 24h114,262185,05412.47%13.28%Holt-Winters 24h233,581263,47028.58%27.36%
The Seasonal Naive 168-hour model produced the lowest average MAE, MAPE and WAPE and was therefore selected for the final 24-hour forecast.
Holt-Winters with weekly seasonality produced a slightly lower RMSE, indicating better performance against some of the larger individual errors, but its average absolute and percentage errors remained higher.
The result also demonstrates an important forecasting principle: a more complex model does not automatically provide a more accurate forecast.
For this dataset, the recurring weekly telemetry pattern provided a stronger forecasting baseline than the evaluated Holt-Winters configurations.
24-Hour Forecast Result
Following model evaluation, the selected weekly seasonal model was applied to forecast SIEMBIOT event ingestion for the following 24 hours.
Forecast period: Aug 19, 2026 14:00 - Aug 20, 2026 14:00
Forecasted event volume: 22,148,246 events
Average forecasted volume: 922,844 events per hour
Peak forecasted volume: 1,278,860 events per hour
Expected peak: Aug 20, 2026 at approximately 09:00
An empirical forecast interval was also calculated from historical forecasting residuals.
At the expected peak, the approximate 95% empirical interval was:
1,148,162 - 1,457,092 events per hour
The interval represents the range of telemetry volumes that would be reasonably consistent with recent forecasting errors.
Values outside this range should not automatically be classified as malicious activity, but they can provide a useful signal for further operational or security investigation.
Forecast Deviation and Security Context
Time-series forecasting creates a dynamic reference point for evaluating subsequently observed telemetry.
The process can be represented as:
Historical telemetry -> Forecast expected activity -> Observe actual activity -> Measure forecast deviation -> Investigate significant changes
For example:
Forecast: 920,000 events/hour
Actual: 1,450,000 events/hour
Result: Activity significantly above the expected baseline
A large deviation may have several explanations, including:
increased endpoint or user activity;
onboarding of new telemetry sources;
logging configuration changes;
vulnerability scanning;
automated external activity;
software deployment;
ingestion degradation;
infrastructure problems;
or security-related activity.
Deviations below the expected range are also relevant.
A persistent reduction in event volume may indicate collector problems, broken parsers, unavailable log sources or other conditions affecting monitoring coverage.
The forecast therefore provides investigation context rather than independently determining whether a cybersecurity incident has occurred.
Relationship with Anomaly Detection
Forecasting and anomaly detection address complementary questions.
Time-series forecasting estimates what telemetry activity is expected to occur in the future.
Anomaly detection identifies observed activity that differs significantly from an expected or previously established pattern.
The two approaches can therefore be combined:
Historical telemetry -> Forecast baseline -> Actual telemetry -> Forecast deviation -> Anomaly investigation
Forecasting can provide an additional dynamic baseline for SIEMBIOT anomaly research while preserving the distinction between an unexpected telemetry pattern and a confirmed security incident.
Operational Value
Forecasting event-ingestion volume can provide useful context for both SOC monitoring and SIEM operations.
Potential operational uses include:
proactive monitoring of telemetry behaviour;
identification of unexpectedly high or low ingestion volumes;
establishment of a dynamic expected baseline;
validation of telemetry continuity;
detection of possible ingestion degradation;
infrastructure and resource planning;
comparison between forecasted and actual security activity.
For infrastructure planning, the average point forecast should not be used as the only capacity reference.
Upper forecast ranges are more useful when evaluating the amount of ingestion capacity that may be required during higher-volume periods.
It is also important to distinguish event count from infrastructure metrics such as events per second (EPS) or data volume.
Hourly event counts do not expose short ingestion bursts, and event count does not translate directly into gigabytes because event size varies between telemetry sources.
Separate forecasting based on shorter time intervals or ingested bytes would therefore be required for detailed SIEM infrastructure sizing.
Limitations
The research has several limitations.
Observation period. The dataset covers 60 days and therefore cannot capture longer monthly, quarterly or annual patterns.
Weekly dependency. The selected model assumes that activity during the upcoming period will remain similar to the corresponding hours of the previous week.
Environmental changes. New log sources, agent deployments, configuration changes or decommissioned systems can change the telemetry baseline and require forecast recalibration.
Known operational events. Maintenance periods and ingestion interruptions must be identified so that they are not incorrectly interpreted as normal telemetry behaviour.
Hourly aggregation. Short event bursts occurring inside an hour are not represented by the hourly forecast and may require forecasting at a finer resolution.
Forecast horizon. The evaluation applies specifically to a 24-hour forecasting horizon. Longer-term forecasts would require separate validation.
Conclusion
A 60-day dataset containing 1,440 hourly SIEMBIOT event-ingestion observations was analysed to determine whether historical security telemetry could be used to forecast expected future activity.
The analysis identified a strong weekly recurring pattern, with approximately 0.78 correlation at a 168-hour lag.
Four forecasting approaches were compared through rolling 24-hour validation.
For the analysed dataset, the 168-hour seasonal forecast produced the best overall performance, achieving an average MAE of approximately 67,455 events per hour and MAPE of approximately 7.18%.
The selected model forecast approximately 22.15 million security events during the following 24-hour period, with an expected average of approximately 922,844 events per hour.
The research demonstrates that historical SIEMBIOT telemetry can be used not only to analyse previously observed activity but also to establish an expected future telemetry baseline.
Comparing this baseline with subsequently observed activity can provide additional context for SOC monitoring, telemetry validation, capacity planning and anomaly investigation.
The forecast itself does not predict a cyberattack or independently identify malicious behaviour. It provides an expected reference against which future telemetry can be measured and investigated.
