Knowing what normal looks like for every account the SOC monitors
The ESH-SOC is integrating behaviour profiles into its monitoring of sign-ins to Microsoft’s cloud. The method comes from a study by TU/e and the SOC, tested on five months of sign-in logs from one of the SOC’s customers, a Dutch IT service provider, and checked by two of its senior IT managers.