A municipal identity console shows a surge of successful logins at…

Question

A municipal identity console shows a surge of successful logins at 3 a.m. from a country the city has never used for remote work, far above the normal overnight baseline. What detection idea does this illustrate?

Accepted Answer

Deviation from an established activity baseline can signal compromised accounts or unusual access. — Baselines are the ‘normal pulse’ of the city’s identity system. When login volume jumps at 3 a.m. from a brand-new country, that pulse just flatlined into weird. Spotting the delta—not memorizing every attack name—is how you catch account takeovers early.

Answer

Any login outside business hours is automatically legitimate if MFA was used once last year.

Answer

Geographic distance from city hall proves the traffic is only CDN health checks.

Answer

Baseline comparisons are unnecessary when cloud providers advertise shared responsibility.

A municipal identity console shows a surge of successful logins at 3 a.m. from a country the city has never used for remote work, far above the normal overnight baseline. What detection idea does this illustrate?

Short Explanation

Full Explanation