There's a natural impulse to treat a simple baseline as the finish line. It's not. A heuristic search that flags authentications above or below normal is a solid starting point, but it's only that. The real question isn't whether you *can* upgrade to an ML model like DensityFunction. It's whether your data has started to outgrow the rules you've built around it.
Think about what a baseline actually does. It measures central tendency and variance, then flags what falls outside those bounds. That works when your environment is stable, when the patterns you care about are static, and when the cost of a missed signal is low. But the moment your data becomes noisy, seasonal, or influenced by external factors, a fixed threshold starts lying to you. The same login volume that looks normal in February looks suspicious in December. A heuristic can't learn that. It can only repeat what you've already told it to expect.
Here's the practical signal for when to transition: when your baseline produces too many false positives, or worse, misses anomalies because they don't spike hard enough to trip a threshold. DensityFunction and similar models don't just look at raw counts. They learn the shape of your data, the relationships between variables, and what "normal" means in context. That's the point where a static rule becomes a liability. You're no longer asking "is this above average?" You're asking "does this look like something we've never seen before?" That's a fundamentally different question, and it demands a different tool.
As for the books, you won't find a single title that maps directly to this exact use case. But look for work on anomaly detection and time series analysis that emphasizes model selection over algorithm recipes. Something that discusses when to use unsupervised methods versus supervised ones, and how to evaluate model drift over time. The goal isn't to master every algorithm. It's to understand the tradeoffs between interpretability and adaptability. Start there, and you'll know exactly when your baseline has hit its ceiling.