Blue Team
search
⌘Ctrlk
Blue Team
  • Model
    • Asset Inventory
    • Network Mapping
    • Operational Activity Mapping
    • System Mapping
  • Harden
    • Agent Authentication
    • Application Hardening
    • Credential Hardening
    • Message Hardening
    • Platform Hardening
    • Source Code Hardening
  • Detect
    • File Analysis
    • Identifier Analysis
    • Message Analysis
    • Network Traffic Analysis
    • Physical Access Monitoring
    • Platform Monitoring
    • Process Analysis
    • User Behavior Analysis
      • Authentication Event Thresholding
      • Authorization Event Thresholding
      • Credential Compromise Scope Analysis
      • Domain Account Monitoring
      • Job Function Access Pattern Analysis
      • Local Account Monitoring
      • Resource Access Pattern Analysis
      • Session Duration Analysis
      • User Data Transfer Analysis
      • User Geolocation Logon Pattern Analysis
      • Web Session Activity Analysis
  • Isolate
    • Access Mediation
    • Access Policy Administration
    • Content Filtering
    • Execution Isolation
    • Network Isolation
  • Deceive
    • Decoy Environment
    • Decoy Object
  • Evict
    • Credential Eviction
    • Object Eviction
    • Process Eviction
  • Restore
    • Restore Access
    • Restore Object
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Detect

User Behavior Analysis

Authentication Event Thresholdingchevron-rightAuthorization Event Thresholdingchevron-rightCredential Compromise Scope Analysischevron-rightDomain Account Monitoringchevron-rightJob Function Access Pattern Analysischevron-rightLocal Account Monitoringchevron-rightResource Access Pattern Analysischevron-rightSession Duration Analysischevron-rightUser Data Transfer Analysischevron-rightUser Geolocation Logon Pattern Analysischevron-rightWeb Session Activity Analysischevron-right
PreviousSystem Call Analysischevron-leftNextAuthentication Event Thresholdingchevron-right