The unusual suspects: Effectively identifying threats via unusual behaviors

The report outlines Red Canary’s method for reducing noise and improving threat detection in identity, cloud, and SaaS environments by combining user baselines, real-time anomaly detection, and agentic investigation workflows. By establishing per-user and organizational baselines, flagging unusual behaviors at scale, and enriching them with 40+ contextual questions (e.g., ISP rarity, VPN/TOR use, MFA changes), the approach aims to distinguish benign anomalies from true risks and deliver higher-fidelity, analyst-ready findings.