Critical infrastructure stakeholders need to baseline their networks to understand expected communications. Current, top-down approaches to baselining rely on generally available observables but lack properties upon which traditional statistical tools depend. This talk will propose constructing micro-baselines: signatures within operational networks based on observables associated with specific events.