Hello,
I am looking for ways to profile a user's "typical" account usage. For instance, if a user normally logs in from 8am - 5pm, but then all the sudden the user starts logging into a system at 12am that wouldn't be normal in most cases.
Another idea... Logon duration times, multi-machine logins, etc.
Just curious if anyone is doing any use profiling in this manner that's easily duplicated in our environment. We log everything (even process execution).
Thanks
