Glossary: Logs and Data Sources for Investigations
Baseline
What normal activity looks like, so that unusual activity stands out. A month of daily reports showed that sam never signed in over SSH, so the attacker's sign-in was clearly abnormal.
Glossary: Logs and Data Sources for Investigations
What normal activity looks like, so that unusual activity stands out. A month of daily reports showed that sam never signed in over SSH, so the attacker's sign-in was clearly abnormal.