Investigate your data using threshold and outlier analysis. By understanding the relative occurrence or frequency of behaviors on your systems it gives you a more accurate detection of anomalies.
By discovering the normal or expected patterns of activity, you can identify exceptions to these patterns based on evidence rather than rule-of thumb thresholds.