Question

A SOC analyst is asked to detect previously unseen insider threats in authentication logs where no labeled examples of malicious behavior exist. Leadership wants an AI-powered analytic technique that can surface unusual login patterns without predefined signatures. Which technique should the analyst recommend?

Accepted Answer

Unsupervised anomaly detection that models a behavioral baseline and flags deviations

Answer

Supervised classification trained on a labeled dataset of known-bad logins

Answer

Static signature matching against a threat intelligence indicator feed

Answer

Regular expression parsing of log fields into a normalized schema