SYSTEM ANALYSIS AND CONTROL SECTION

Determining Anomalous Behavior Of Entities In Large IT StructuresAs IT systems scale rapidly, cybersecurity gaps often emerge — especially in structures built by different teams without a unified security approach. Our research proposes a combined method for detecting suspicious user activity by integrating OS-level triggers, UAM (User Activity Monitoring) agents, and centralized SIEM log analysis. This layered model enables early threat detection, even before full security systems are deployed. By correlating logs from Linux/Windows tools, real-time triggers, and dashboards in Kibana, we detect both overt and hidden anomalies in user behavior. The system is scalable, flexible, and can be further enhanced with AI for automated analysis and prediction. Developed under the TELEMETRY project (Horizon Europe), this solution helps organizations react faster and smarter to security threats.