RSI TECH
Contact
Work index

delivered / program / Security Analytics / 2019 -> 2022

Security Ops: User Behavior Analytics & Anomaly Detection

Behavioral baselines and explainable anomaly signals for SOC triage and investigation.

System fingerprint

Select a signal node to inspect its operating principle.

  1. TelemetryNormalize multi-source logs.
  2. BaselinesModel user, session, and device behavior.
  3. SignalsScore anomalies with controllable thresholds.
  4. SOC triageKeep every alert explainable.

01 / Evidence

Outcome

  • Processed enterprise directory, proxy, and endpoint telemetry at scale.
  • Surfaced meaningful anomalies through unsupervised detection.
  • Kept the system auditable through analyst iteration and methodology documentation.

02 / Operating environment

Context

Large-scale telemetry -> behavioral baselines -> explainable anomaly signals for SOC workflows.

Security operations teams working with enterprise telemetry

03 / Boundary conditions

Constraints

  1. C01

    Data volume is high; latency and cost constraints matter.

  2. C02

    Explainability is mandatory: an alert must be debuggable.

  3. C03

    Signals must remain useful when data is sparse or partially missing.

04 / Decision path

Architecture

Select a signal node to inspect its operating principle.

  1. TelemetryNormalize multi-source logs.
  2. BaselinesModel user, session, and device behavior.
  3. SignalsScore anomalies with controllable thresholds.
  4. SOC triageKeep every alert explainable.

05 / Engineering choices

Key decisions

  • D1Use a Spark-first design to keep throughput stable under growth.
  • D2Build behavioral baselines for users, sessions, and devices.
  • D3Treat signal methodology and trigger behavior as documented deliverables.

06 / Proof discipline

Evaluation

  • Iterate with analysts in the loop.
  • Tune unsupervised scores and thresholds for SOC triage and investigation.
  • Control false positives while preserving explainable alert signals.

07 / Scope

Ownership

Data pipeline, feature engineering, anomaly detection, and methodology documentation

  1. O01

    Multi-source log ingestion and normalization

  2. O02

    Behavioral feature extraction and baselines

  3. O03

    Unsupervised scoring, thresholds, and methodology documentation

08 / Explicit compromises

Trade-offs

  • Prefer debuggable signals over black-box alerts.
  • Degrade gracefully under sparse or partially missing data.

Implementation stack

PySpark / Python / Unsupervised learning / Feature engineering / Log pipelines

From evidence to delivery

Related production services

  • Production AI and LLM systems

    Explainable signals, controllable thresholds and documented operating behavior show the shared production engineering discipline.

Next evidence

More work

delivered / Data PlatformsAutomated Time-Series Forecasting FrameworkA repeatable forecasting workflow made model comparisons safer and iteration easier to hand over.delivered / Data PlatformsMarketing Analytics & Incremental Lift OptimizationIncrementality-focused measurement and targeting models connected model outputs to budget and campaign decisions.