What is required in order to perform attack detection using anomaly detection technologies?

Packet captures are a forensic and investigative tool used after detection or for manual analysis, not a prerequisite for the anomaly detection engine itself.

Exploit signatures are the foundation of signature-based (misuse) detection systems, not anomaly detection, which works without any knowledge of specific attack patterns.

Anomaly detection engines build a statistical profile of normal network activity - including typical traffic volumes, protocols, connection rates, and patterns - and flag deviations from that profile as potential attacks. Without baseline data, the system has no reference point to distinguish normal activity from malicious activity, making detection impossible.

Syslog data provides event logs for review and SIEM correlation, but anomaly detection requires statistical behavioral baseline profiles, not log entries, as its core reference.