The trusted baseline is your definition of normal that the security rules measure against:
Known users - who should have access to each account.
Allowed managers - which manager (MCC) accounts may link.
Allowed networks - which ad networks campaigns are permitted on (used by the network-leak rule).
Internal domains - your team's email domain(s), so the invite rule knows what "external" means.
Anything outside these lists is flagged.
How to maintain it:
When you legitimately add a user, manager, or network opt-in, add it to the baseline at the same time.
When someone leaves or an arrangement ends, remove them.
Review the lists quarterly - a stale baseline is the main cause of both false alarms and missed ones.
Good to know. Keeping the baseline current is the single highest-leverage habit for the security rules - it's what makes every alert mean something.