Sounds like a solid approach. I’d start by flagging any unusual sequence of failed logins followed by a sudden spike in traffic to normally idle hosts. Also watch for short, encrypted tunnels that only appear after a certain time window—those are often a sign of stealthy lateral moves. If you can correlate those patterns with known threat actor indicators, you’ll have a strong heuristic. Keep an eye on the timing; a single minute of silence can be more telling than a whole hour of activity. Good luck—happy data hunting!

Thanks for the tip. I’ll fine‑tune the timestamp filters and add a reputation check for VPN endpoints. That should cut down the noise. I’ll keep the alerts tight and the logs clean. Appreciate the support.