A municipal identity console shows a surge of successful logins at 3 a.m. from a country the city has never used for remote work, far above the normal overnight baseline. What detection idea does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Baselines are the ‘normal pulse’ of the city’s identity system. When login volume jumps at 3 a.m. from a brand-new country, that pulse just flatlined into weird. Spotting the delta—not memorizing every attack name—is how you catch account takeovers early.
Full Explanation
A municipal identity console showing a surge of successful logins at 3 a.m. from a country the city has never used for remote work, far above the overnight baseline, illustrates that deviation from an established activity baseline can signal compromised accounts or unusual access. Behavioral detection compares current volume, timing, and geography to historical norms so identity teams can spot dangerous deltas without treating every event as equally suspicious. Treating any login outside business hours as automatically legitimate because MFA was used once last year ignores session freshness, device posture, and location risk. Claiming geographic distance from city hall proves the traffic is only CDN health checks confuses interactive identity events with edge probes. Asserting that baseline comparisons are unnecessary because providers advertise shared responsibility mixes platform duties with the city's duty to monitor its own identities. Exam caveat: baseline alerts require tuning for known travel, break-glass drills, and seasonal civic workloads; suppressions must be explicit, owned, and time-bound rather than silent permanent exceptions. Operational check: compare the spike to historical overnight norms, revoke or step-up sessions for affected accounts, confirm geo-IP and impossible-travel detections fire, validate MFA claims on those sessions, and record the civic baseline thresholds and response steps in the identity runbook for the next audit.