UPDATED · 20 JUN 2026 · EDIT ON GITHUB
GUIDES · SECTORS

Financial services: trading-floor SOC.

On a trading floor the crown jewels are identities and the clock is the market. Detections lead with identity, evidence is retained the way regulators require, and normal is defined per trading session — not as a flat 24-hour average.

14 min read Intermediate By C. Jian

Identity-first detections

Privileged trading and settlement access is the highest-value target, so the strongest detections watch identity: a dormant trader credential waking up, privileged access from an unusual session, an entitlement change outside a change window.

YAMLprivileged access, off-session
when: stream: identity.signin match: actor.role: trading-privileged session.market_hours: false baseline: per_entity window: 5m

Supervision & retention

Evidence is sealed on arrival and written once — WORM by default — so the retention and supervision obligations specific to broker-dealers are met by how data is stored, not by a separate archiving job.

ObligationHow it is met
Immutable recordsEvidence hashed on arrival, written once to WORM storage.
RetentionConfigurable hot window plus multi-year cold tier in your account.
Supervisory reviewEvery analyst action is an event — the review trail is inherent.

Market-hours baselines

A flat baseline flags every after-hours batch job and misses the quiet anomaly mid-session. Baselining per trading session holds each entity to the rhythm of the market it works in.

Normal has a calendar. Per-session baselines learn that settlement runs after close and that the floor is quiet overnight, so a privileged login at 3am stands out exactly because the model knows it should not be there.

Where to go next

← PREV Healthcare: PHI-safe investigation NEXT → OT / ICS detection patterns