Creating user baseline reports to identify malicious logins

The report outlines Red Canary’s method for creating dynamic, per-user identity baselines to improve detection and investigation of anomalous logins in cloud and SaaS environments. It describes a workflow that extracts and enriches 30 days of identity logs, applies Apriori analysis to identify common patterns and isolation forests for anomaly detection, and leverages LLM-generated summaries to provide concise, contextual insights that help analysts distinguish normal behavior from suspicious activity and reduce alert noise.