Andreas Wolter takes a look at an alert:
This week, early morning, a customer alerted me that my account was possibly involved in an incident.
The alert came from Rapid7 InsightIDR:
Andreas has an example in which the SIEM decided that his user account was the relevant one, despite there being no logged in user. It’s an interesting story around how it’s critical to understand your sources and what they’re actually telling you.