A two-stage funnel for insider threat detection
CERT r4.2, 330,285 user-day windows, and the case for letting each stage of a detector be bad at something on purpose.
CERT r4.2, 330,285 user-day windows, and the case for letting each stage of a detector be bad at something on purpose.