I appreciate the reply. When you say you do this for a living, what do you mean? Is your role to sniff this sort of thing out, a whole company, or part of your job on a team?
I agree, none of this is evidence, just intel here. Not sure if we have Defender ATP. We have MDE, which I am starting to dig into now. I don't have direct access, so just looking through pulls after I make a request. For the devs, a simple glance at their gitlab contributions tells you a lot. For remote folks the VPN is another like the logins. The truly lazy won't even bother to be on the VPN, but doesn't mean they are not working. Apparently one of our main sys admins is never on the VPN.
It would be nice if some of the enterprise licensed tools gave some metrics like Outlook, intelliJ/VSCode, and Gitlab, all overlaid on a simple bar chart of activity. It would be pretty easy to see gaps and to piece together a work day. I realize that doesn't account for whiteboard time etc, but that stuff is explainable. 3-4 hours per day of activity + very low contributions is not explainable.
I don't think we have gone up against a real professional yet. If they are here, they are really good. It's a pretty small team and low output sticks out like a sore thumb.
I agree, none of this is evidence, just intel here. Not sure if we have Defender ATP. We have MDE, which I am starting to dig into now. I don't have direct access, so just looking through pulls after I make a request. For the devs, a simple glance at their gitlab contributions tells you a lot. For remote folks the VPN is another like the logins. The truly lazy won't even bother to be on the VPN, but doesn't mean they are not working. Apparently one of our main sys admins is never on the VPN.
It would be nice if some of the enterprise licensed tools gave some metrics like Outlook, intelliJ/VSCode, and Gitlab, all overlaid on a simple bar chart of activity. It would be pretty easy to see gaps and to piece together a work day. I realize that doesn't account for whiteboard time etc, but that stuff is explainable. 3-4 hours per day of activity + very low contributions is not explainable.
I don't think we have gone up against a real professional yet. If they are here, they are really good. It's a pretty small team and low output sticks out like a sore thumb.