Workplace / insider-risk monitoring
ACTIVE CAPABILITYUser Activity Monitoring (UAM)
UAM is the technical capability to observe and record an individual’s activity on systems in order to detect insider threats and support authorized investigations. Commercial workplace-monitoring systems can implement related capabilities outside government.
- HOW YOU ENCOUNTER IT
- Using an employer-managed computer, account, network, or other monitored work system.
- DATA
- Login/activity events · Application and resource access · File or network activity · Other endpoint telemetry depending on implementation