Financial services: trading-floor SOC.
On a trading floor the crown jewels are identities and the clock is the market. Detections lead with identity, evidence is retained the way regulators require, and normal is defined per trading session — not as a flat 24-hour average.
Identity-first detections
Privileged trading and settlement access is the highest-value target, so the strongest detections watch identity: a dormant trader credential waking up, privileged access from an unusual session, an entitlement change outside a change window.
YAMLprivileged access, off-session when: stream: identity.signin match: actor.role: trading-privileged session.market_hours: false baseline: per_entity window: 5m
Supervision & retention
Evidence is sealed on arrival and written once — WORM by default — so the retention and supervision obligations specific to broker-dealers are met by how data is stored, not by a separate archiving job.
| Obligation | How it is met |
|---|---|
| Immutable records | Evidence hashed on arrival, written once to WORM storage. |
| Retention | Configurable hot window plus multi-year cold tier in your account. |
| Supervisory review | Every analyst action is an event — the review trail is inherent. |
Market-hours baselines
A flat baseline flags every after-hours batch job and misses the quiet anomaly mid-session. Baselining per trading session holds each entity to the rhythm of the market it works in.
Where to go next
- Financial services solution — the full sector view.
- Tuning behavioral models — tune the baselines.