Chapter 3 — Security operations and blue team: specialist evidence
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Specialist evidence"]
N2["3.2 Insider risk"]
N3["3.3 Peer baselines"]
N4["Lab — peer comparison"]
N5["3.4 Reading the result"]
N6["3.5 Interpreting outliers"]
N7["3.6 Fairness and privacy"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Specialist evidence"]
N2["3.2 Insider risk"]
N3["3.3 Peer baselines"]
N4["Lab — peer comparison"]
N5["3.4 Reading the result"]
N6["3.5 Interpreting outliers"]
N7["3.6 Fairness and privacy"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Specialist evidence]
|
v
[3.2 Insider risk]
|
v
[3.3 Peer baselines]
|
v
[Lab — peer comparison]
|
v
[3.4 Reading the result]
|
v
[3.5 Interpreting outliers]
|
v
[3.6 Fairness and privacy]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) use specialist evidence such as access logs, peer baselines and business context; (2) build peer-group comparisons for insider-risk monitoring; (3) interpret outliers carefully; (4) protect fairness and privacy in people-focused monitoring.
3.1 Specialist evidence
Some SOC questions need evidence beyond network and endpoint logs: application access logs, HR role data and business workload. At Meridian, claims-system logs record each record a handler opens. These sources answer questions that endpoint telemetry cannot, such as whether a handler's access matched assigned work. Using them needs agreement from the system owners and HR, and a clear purpose recorded before analysis begins. At Meridian, access to claims logs for monitoring was agreed with the claims system owner, HR and staff representatives, with the purpose written into the insider-risk policy before any baseline was computed.
3.2 Insider risk
Insurers worry about staff viewing records without business need, for curiosity or fraud. Monitoring such access must be fair: people are compared with peers doing similar work, not with the whole company. At Meridian, claims handlers in different teams have very different workloads, so a company-wide threshold would flag busy teams and miss unusual individuals in quiet ones. Peer comparison makes the baseline fair to each team, and the fairness policy decides who may see a flag and when. At Meridian, each peer group is one claims team.
3.3 Peer baselines
A peer-group median is robust to one unusual person. Comparing each handler's weekly views with their team's median highlights unusual workloads. Meridian's lab computes a weekly median of record views for each team and divides each handler's views by it, so a ratio near 1 means typical workload. A ratio well above that is a flag for review. Because the median ignores a single extreme value, the person being flagged cannot raise their own team's baseline enough to hide, and a quiet week for one colleague does not make everyone else look busy.
Lab — peer comparison
"""Compare each claims handler's record views with their peer-group median (synthetic, one week)."""
import statistics
views = {"team-A": {"h01": 410, "h02": 395, "h03": 430, "h04": 1260, "h05": 405},
"team-B": {"h11": 120, "h12": 135, "h13": 128, "h14": 118, "h15": 131}}
for team, people in views.items():
med = statistics.median(people.values())
for h, v in people.items():
ratio = v / med
print(f"{team} {h} views={v:5} peer median={med:5.0f} ratio={ratio:4.2f} {'REVIEW' if ratio >= 2.5 else ''}")
Run with python3 lab_peer.py. Verified output:
team-A h01 views= 410 peer median= 410 ratio=1.00
team-A h02 views= 395 peer median= 410 ratio=0.96
team-A h03 views= 430 peer median= 410 ratio=1.05
team-A h04 views= 1260 peer median= 410 ratio=3.07 REVIEW
team-A h05 views= 405 peer median= 410 ratio=0.99
team-B h11 views= 120 peer median= 128 ratio=0.94
team-B h12 views= 135 peer median= 128 ratio=1.05
team-B h13 views= 128 peer median= 128 ratio=1.00
team-B h14 views= 118 peer median= 128 ratio=0.92
team-B h15 views= 131 peer median= 128 ratio=1.02
3.4 Reading the result
In team A, h04 viewed 1,260 records against a peer median of 410 — a ratio of 3.07, flagged for review. All other handlers in both teams are within 0.92–1.05 of their medians. Team B's lower volumes do not distort team A's comparison because each team has its own baseline. The result is a single flag, not a finding about h04's conduct. The review then looks for a business reason, which in this case was the assignment of 900 legacy claims for a migration project.
3.5 Interpreting outliers
A flag is a question, not an accusation. High volume may reflect assignment to a backlog, a special project or a data-quality task. At Meridian, h04's flag turned out to be a migration project, and the assignment table showed every viewed record was assigned. The reviewer recorded that explanation and closed the flag without telling h04's manager, as the fairness policy requires. Adding assignment data as enrichment means similar project work will be explained before a reviewer ever sees it.
3.6 Fairness and privacy
Insider-risk monitoring is governed by policy agreed with HR, legal and staff representatives. Reviews are done by a small, trained group; managers are not told of flags unless review finds a concern. In h04's case, the review group checked the assignment table and closed the flag; the manager was never told. Audit of the reviewers' own searches shows that the access granted for monitoring is used only for it. Staff representatives receive annual figures on flags and outcomes, which lets them check that monitoring falls fairly across teams.
Worked example
Daniel's analyst checks the claims system's assignment table: h04 was assigned 900 legacy claims for a migration project that week. Views were of assigned records only. The flag is closed with a note, and the assignment data is added as enrichment so future project work is visible automatically.
Synthetic case. Handlers and figures come from the lab script.
Errors and limits
Peer baselines fail when a team is small or roles differ within it.
Exercises
- EX011 — Peer median. Why compare to a peer-group median rather than the company average? Rubric: 3 = similar work; robust to one outlier; 2 = partial; 1 = no reason; 0 = none.
- EX012 — Lab flag. Which handler was flagged and with what ratio? Rubric: 3 = h04, 1,260 vs 410, ratio 3.07; 2 = partial; 1 = wrong; 0 = none.
- EX013 — Outlier meaning. What does a flag mean in insider monitoring? Rubric: 3 = a question to review, not an accusation; 2 = partial; 1 = guilt; 0 = none.
- EX014 — Governance. Who agrees the insider-monitoring policy? Rubric: 3 = HR, legal, staff representatives (with SOC); 2 = two; 1 = one; 0 = none.
- EX015 — Flag resolution. How was h04's flag resolved and what changed? Rubric: 3 = migration assignment; closed; assignment data added as enrichment; 2 = partial; 1 = vague; 0 = none.
Synthesis
Specialist evidence enables insider-risk monitoring, but only with fair baselines, context and strong governance.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →