Glossary: Monitoring Tools and the Identity Life Cycle

Indicator of compromise

A sign that an attacker may be present. Someone signing in interactively with a service account is one.