Smart Lock Audit Trail & Forensic Analysis: Complete Investigation Guide

1. User Access Logs:
   - Who accessed finance systems/areas
   - When (date/time with timezone)
   - What (specific system/room accessed)
   - Duration of access
   
2. Change Management:
   - Log all access permission changes
   - Require approval workflow
   - Retain change audit trail (7 years)
   
3. Segregation of Duties:
   - Prevent single individual from having conflicting access
   - Alert on SoD violations
   - Document compensating controls
   
4. Periodic Review:
   - Quarterly access review and certification
   - Annual external audit of controls
   - Audit trail integrity verification

{
  "event_id": "evt_a7b3c9d2e1f4g5h6",
  "timestamp": "2024-02-18T14:32:17.384Z",
  "timestamp_unix": 1708267937384,
  "timezone": "UTC",
  
  "event_type": "access_granted",
  "event_category": "authentication",
  "severity": "INFO",
  
  "user": {
    "user_id": "emp_12345",
    "username": "john.doe@company.com",
    "display_name": "John Doe",
    "department": "Engineering",
    "role": "Employee",
    "employee_type": "Full-Time"
  },
  
  "credential": {
    "credential_type": "PIN",
    "credential_id": "pin_abc123",
    "credential_value_hash": "sha256:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
  },
  
  "door": {
    "door_id": "door_101",
    "door_name": "Main Entrance - Building A",
    "location": "Building A, Floor 1",
    "zone": "Public",
    "classification": "Standard"
  },
  
  "device": {
    "lock_id": "lock_2547",
    "lock_model": "Schlage Encode Plus",
    "firmware_version": "2.5.3",
    "network_address": "192.168.1.100",
    "signal_strength": -65
  },
  
  "result": {
    "status": "SUCCESS",
    "reason_code": null,
    "duration_ms": 147,
    "retry_count": 0
  },
  
  "context": {
    "scheduled_access": true,
    "escort_required": false,
    "visitor": false,
    "entry_direction": "IN",
    "weather_event": false
  },
  
  "security": {
    "anomaly_score": 0.12,
    "risk_level": "LOW",
    "alert_triggered": false,
    "geolocation": "40.7589,-73.9851"
  },
  
  "audit": {
    "log_source": "smart_lock_gateway",
    "log_version": "1.2",
    "chain_hash": "sha256:prev_event_hash",
    "signature": "RSA_signature_of_this_event"
  },
  
  "metadata": {
    "session_id": "sess_xyz789",
    "correlation_id": "corr_meeting_345",
    "external_ref": "calendar_event_12345"
  }
}

const crypto equals require('crypto');

class TamperProofAuditLogger {
  constructor(storage) {
    this.storage equals storage;
    this.previousHash equals null;
    this.privateKey equals this.loadPrivateKey(); // HSM or secure storage
  }
  
  async logEvent(event) {
    // Step 1: Add timestamp if not present
    if (!event.timestamp) {
      event.timestamp equals new Date().toISOString();
      event.timestamp_unix equals Date.now();
    }
    
    // Step 2: Generate event ID
    event.event_id equals this.generateEventId();
    
    // Step 3: Calculate chain hash (links to previous event)
    if (this.previousHash) {
      event.audit equals event.audit || {};
      event.audit.previous_hash equals this.previousHash;
      
      // Chain hash equals SHA256(previous_hash + current_event_data)
      const eventData equals this.canonicalizeEvent(event);
      const chainInput equals this.previousHash + eventData;
      event.audit.chain_hash equals crypto
        .createHash('sha256')
        .update(chainInput)
        .digest('hex');
    } else {
      // First event in chain (genesis block)
      event.audit equals { chain_hash: 'GENESIS' };
    }
    
    // Step 4: Digital signature (non-repudiation)
    const eventData equals this.canonicalizeEvent(event);
    const signature equals crypto.sign(
      'sha256',
      Buffer.from(eventData),
      this.privateKey
    );
    event.audit.signature equals signature.toString('base64');
    
    // Step 5: Store event (write-once storage)
    await this.storage.append(event); // Append-only
    
    // Step 6: Update previous hash for next event
    this.previousHash equals event.audit.chain_hash;
    
    // Step 7: Verify chain integrity periodically
    if (event.event_id.endsWith('000')) { // Every 1000 events
      await this.verifyChainIntegrity();
    }
    
    return event.event_id;
  }
  
  canonicalizeEvent(event) {
    // Create deterministic string representation (sorted keys)
    const canonical equals JSON.stringify(event, Object.keys(event).sort());
    return canonical;
  }
  
  async verifyChainIntegrity(startEventId, endEventId) {
    const events equals await this.storage.getRange(startEventId, endEventId);
    
    let previousHash equals null;
    for (const event of events) {
      // Verify signature
      const eventData equals this.canonicalizeEvent(event);
      const isValidSignature equals crypto.verify(
        'sha256',
        Buffer.from(eventData),
        this.publicKey,
        Buffer.from(event.audit.signature, 'base64')
      );
      
      if (!isValidSignature) {
        throw new Error(`Invalid signature for event ${event.event_id}`);
      }
      
      // Verify chain hash
      if (previousHash && event.audit.previous_hash !=equals previousHash) {
        throw new Error(`Broken chain at event ${event.event_id}`);
      }
      
      previousHash equals event.audit.chain_hash;
    }
    
    return { valid: true, eventsVerified: events.length };
  }
  
  generateEventId() {
    // Time-sortable UUID (ULID-style)
    const timestamp equals Date.now().toString(36);
    const random equals crypto.randomBytes(10).toString('base64url');
    return `evt_${timestamp}_${random}`;
  }
}

// Usage
const logger equals new TamperProofAuditLogger(wormStorage);

await logger.logEvent({
  event_type: 'access_granted',
  user_id: 'emp_12345',
  door_id: 'door_101'
});

// Later: Verify integrity (for auditors, forensics)
await logger.verifyChainIntegrity('evt_start', 'evt_end');
// Returns: { valid: true, eventsVerified: 10000 }

├─ Access outside normal hours
│   ├─ Example: Employee typically works 9-5, accesses at 2am
│   ├─ Baseline: 30-day access pattern
│   └─ Alert: Access ±4 hours from typical range
│
├─ Unusual access frequency
│   ├─ Example: 20 accesses in 1 hour (normal: 3-5/day)
│   ├─ Detection: Z-score >3 from mean
│   └─ Alert: Rate 3× historical average

2. Sequential Anomalies
├─ Impossible travel (piggybacking/credential sharing)
│   ├─ Example: Building A at 10:00am, Building B at 10:05am (15 miles apart)
│   ├─ Calculation: Distance ÷ Time = Required speed
│   └─ Alert: Speed >30 mph or simultaneous access
│
├─ Unusual access sequence
│   ├─ Example: Exec suite → Server room → Back exit (normal: Front → Office → Exec)
│   ├─ Detection: Markov chain probability <0.05
│   └─ Alert: Sequence never seen in last 90 days

3. Peer Group Anomalies
├─ Deviation from department norms
│   ├─ Example: Marketing employee accessing R&D lab
│   ├─ Baseline: Department typical access zones
│   └─ Alert: Zone access by <5% of peer group
│
├─ Privilege escalation
│   ├─ Example: Standard user accessing admin-only doors
│   ├─ Detection: Access level mismatch
│   └─ Alert: Door requires level >user.level

4. Behavioral Anomalies
├─ Login without physical access
│   ├─ Example: User logged into workstation but no door entry
│   ├─ Correlation: Badge swipe + network login
│   └─ Alert: Network activity without physical presence
│
├─ Extended duration access
│   ├─ Example: Remains in secure zone 18 hours (normal: 2-3 hours)
│   ├─ Detection: Time since last exit >2σ
│   └─ Alert: Duration exceeds 95th percentile

# Simplified anomaly detection model
import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

class AccessAnomalyDetector:
    def __init__(self):
        self.model = IsolationForest(
            contamination=0.05,  # Expect 5% anomalies
            random_state=42,
            n_estimators=100
        )
        self.scaler = StandardScaler()
        self.is_trained = False
    
    def extract_features(self, access_event):
        """Convert access event to feature vector"""
        features = [
            access_event['hour_of_day'],          # 0-23
            access_event['day_of_week'],          # 0-6
            access_event['access_frequency_1h'],  # Count last hour
            access_event['access_frequency_24h'], # Count last day
            access_event['time_since_last'],      # Minutes
            access_event['door_security_level'],  # 1-5
            access_event['user_clearance_level'], # 1-5
            access_event['distance_from_last'],   # Meters (if GPS)
        ]
        return np.array(features)
    
    def train(self, historical_events):
        """Train on 30+ days of normal access patterns"""
        X = np.array([
            self.extract_features(event) 
            for event in historical_events
        ])
        
        # Normalize features
        X_scaled = self.scaler.fit_transform(X)
        
        # Train model
        self.model.fit(X_scaled)
        self.is_trained = True
        
        return self.model.score_samples(X_scaled)
    
    def predict(self, access_event):
        """Predict if event is anomalous"""
        if not self.is_trained:
            raise ValueError("Model not trained")
        
        features = self.extract_features(access_event)
        features_scaled = self.scaler.transform([features])
        
        # Get anomaly score (-1 = anomaly, 1 = normal)
        prediction = self.model.predict(features_scaled)[0]
        
        # Get anomaly score (lower = more anomalous)
        score = self.model.score_samples(features_scaled)[0]
        
        return {
            'is_anomaly': prediction == -1,
            'anomaly_score': score,
            'confidence': abs(score)
        }

# Usage
detector = AccessAnomalyDetector()

# Train on 30 days of normal access
detector.train(historical_access_events)

# Real-time detection
result = detector.predict(new_access_event)

if result['is_anomaly']:
    alert_security({
        'event': new_access_event,
        'anomaly_score': result['anomaly_score'],
        'severity': 'HIGH' if result['confidence'] > 0.5 else 'MEDIUM'
    })

├─ Simultaneous badge use (credential sharing confirmed)
├─ Access to restricted zone by unauthorized user
├─ Forced entry detected (tamper alarm + access)
├─ After-hours access to high-value asset storage
└─ Action: SMS + phone call security, lock door remotely

HIGH (Response - 15 min):
├─ Impossible travel between locations
├─ Access outside normal hours (>4 hours deviation)
├─ Multiple failed access attempts (>5 in 10 min)
├─ Unusual access sequence (never seen pattern)
└─ Action: Email + SMS security, log detailed review

MEDIUM (Response - 1 hour):
├─ Access frequency 2-3× normal
├─ First-time access to new zone
├─ Weekend access (when normally weekday-only)
├─ Peer group deviation (access <10% of peers visit)
└─ Action: Log for review, notify supervisor

LOW (Response - Daily review):
├─ Slightly outside normal hours (2-4 hour deviation)
├─ Access frequency 1.5-2× normal
├─ Minor sequence deviation
└─ Action: Include in daily report

├─ Incident timeframe (start/end dates)
├─ Affected resources (doors, systems, data)
├─ Suspected actors (user IDs, badge numbers)
├─ Investigation goals (timeline, attribution, impact)
└─ Legal holds (preserve evidence)

Step 2: Collect Relevant Logs
├─ Access control events (door unlock, badge swipe)
├─ Audit trail (configuration changes, user management)
├─ Video surveillance (if correlated by time/location)
├─ Network logs (if investigating data exfiltration)
├─ Badge issuance/deactivation records
└─ HR records (employment dates, access approvals)

Step 3: Establish Chain of Custody
├─ Document who collected evidence
├─ Document when and how collected
├─ Cryptographic hash of log files (integrity)
├─ Store in secure, tamper-proof location
└─ Maintain access log for evidence itself

1. Extract Events
   ├─ Query audit logs for timeframe
   ├─ Filter by user, location, or event type
   ├─ Export to analysis format (CSV, JSON)
   └─ Verify log integrity (chain hash, signatures)

2. Correlate Events
   ├─ Match access events to video footage
   ├─ Cross-reference network activity
   ├─ Identify event sequences (entry → room access → exit)
   └─ Flag timing inconsistencies

3. Visualize Timeline
   ├─ Chronological event list
   ├─ Access heatmap (locations × time)
   ├─ Network graph (user movements between doors)
   └─ Anomaly highlights (red flags)

Investigation: Suspected Data Theft - Employee ID 5432
Timeframe: 2024-01-15 18:00 to 2024-01-16 06:00

Timeline:
18:45 │ ● Badge swipe - Main entrance (NORMAL)
18:46 │ ● Network login - Workstation WS-1234 (NORMAL)
19:15 │ ● Badge swipe - Server room (ANOMALY - after hours)
      │   └─ Alert generated: User 5432 rarely accesses server room
19:18 │ ● Network activity spike - 2.3GB upload to external IP
      │   └─ Correlation: Server room access + large upload
19:42 │ ● Badge swipe - Server room exit
19:45 │ ● Network logout - Workstation WS-1234
19:47 │ ● Badge swipe - Main entrance exit
      │
23:30 │ ● Badge swipe - Main entrance (ANOMALY - midnight return)
23:32 │ ● Badge swipe - Executive suite (CRITICAL - unauthorized)
      │   └─ User 5432 has NO authorization for exec suite
23:55 │ ● Failed badge swipe - Records room (×3 attempts)
00:12 │ ● Badge swipe - Executive suite exit
00:15 │ ● Badge swipe - Main entrance exit

FINDINGS:
- Confirmed unauthorized access to executive suite
- Possible data exfiltration (2.3GB during server room visit)
- Multiple anomalies in single evening
- Recommend: Immediate credential suspension, forensic workstation imaging

1. Pattern Analysis
   ├─ Compare suspect behavior to historical baseline
   ├─ Identify deviations from normal patterns
   ├─ Statistical significance testing
   └─ Peer group comparison

2. Correlation Analysis
   ├─ Physical access + digital activity
   ├─ Badge swipe + video confirmation
   ├─ Access timing + data transfer timing
   └─ Multi-user collusion detection

3. Impact Assessment
   ├─ What assets were accessed?
   ├─ What data could have been exposed?
   ├─ Were security controls bypassed?
   └─ Compliance implications (breach notification?)

- Alert: Impossible travel detected
- Users: Employee A (Badge 1001), Employee B (Badge 2002)
- Date: 2024-02-10

Timeline Analysis:
10:15 │ Badge 1001 - Building East, Door 5
10:17 │ Badge 1001 - Building West, Door 12  
      │ └─ ALERT: 2 miles in 2 minutes (impossible)
10:18 │ Video review: Employee B visible using Badge 1001 at West
      │ Employee A confirmed at East via badge + video

Investigation Findings:
- Employee A lent badge to Employee B
- Reason: Employee B forgot badge, needed server room access
- Duration: 2 hours before badge returned
- Violations: Credential sharing policy, unauthorized server access

Actions Taken:
- Both employees written warning
- Mandatory security training
- Badge sharing detection improved (real-time alerts)
- Supervisor notification policy implemented

- Alert: After-hours access to restricted area
- User: IT Admin (elevated privileges)
- Timeframe: 3-week pattern of unusual access

Pattern Analysis:
Week 1:
- 3 after-hours accesses (Fri/Sat/Sun 11pm-2am)
- Locations: Server room, network closet
- Duration: 2-3 hours each visit

Week 2:
- 4 after-hours accesses
- NEW: Access to executive suite (unusual for IT)
- Duration: Increasing to 4-5 hours

Week 3:
- Daily after-hours access
- NEW: Attempted access to CEO office (denied - insufficient clearance)
- Duration: 6-8 hours overnight

Correlation with Other Data:
- Network logs: Large data transfers to personal cloud storage
- HR: Employee gave 2-week notice (resigned)
- Email: Suspicious emails to competitor company

Investigation Conclusion:
- Confirmed data theft
- Estimated 500GB sensitive data exfiltrated
- Legal action initiated
- Credential immediately revoked
- Law enforcement notified

Lessons Learned:
- Implement resignation monitoring (high-risk period)
- Alert on data upload + after-hours access combination
- Require manager approval for after-hours badge access

Smart Lock System
│
├─ Audit Logger
│   └─ Generates structured events (JSON/syslog)
│
├─ Log Forwarder
│   ├─ Protocol: Syslog (RFC 5424), HTTP, or API
│   ├─ Encryption: TLS 1.3
│   └─ Buffering: Local queue (24-hour capacity)
│
└─ SIEM Receiver
    ├─ Splunk
    ├─ Elasticsearch (ELK Stack)
    ├─ Azure Sentinel
    └─ IBM QRadar

<134>1 2024-02-20T10:15:30.123Z smartlock.example.com access-control 
- ID47 [access@32473 
event_type="access_granted" 
user_id="emp_12345" 
user_name="john.doe@example.com"
door_id="door_101" 
door_name="Server Room A" 
method="badge_swipe" 
badge_number="1234567890"
ip="192.168.1.50"
] Access granted - Server Room A - john.doe@example.com

# Failed access attempts by user (brute force detection)
index=access_control event_type="access_denied"
| stats count by user_id, door_id
| where count > 5
| sort -count

# After-hours access (outside 6am-8pm)
index=access_control event_type="access_granted"
| eval hour=strftime(_time, "%H")
| where hour < 6 OR hour >= 20
| stats count by user_name, door_name

# Impossible travel detection
index=access_control event_type="access_granted"
| sort user_id, _time
| streamstats current=f last(_time) as last_time, 
              last(door_location_lat) as last_lat,
              last(door_location_lon) as last_lon by user_id
| eval time_diff_min = (_time - last_time) / 60
| eval distance_km = haversine(door_location_lat, door_location_lon, last_lat, last_lon)
| eval speed_kmh = distance_km / (time_diff_min / 60)
| where speed_kmh > 100
| table user_name, _time, door_name, speed_kmh

# Correlation: Physical access + Network activity
index=access_control event_type="access_granted" door_id="server_room"
| join user_id [search index=network_logs action="large_upload"]
| where network_time - access_time < 300
| table user_name, door_name, bytes_uploaded

ACCESS CONTROL COMPLIANCE REPORT
Period: February 1-28, 2024
Generated: March 1, 2024

1. EXECUTIVE SUMMARY
   - Total Access Events: 45,234
   - Unique Users: 523
   - Doors Monitored: 50
   - Anomalies Detected: 12 (0.026%)
   - Security Incidents: 2 (both resolved)

2. HIPAA COMPLIANCE (§164.312(b))
   ✅ Audit controls enabled: YES
   ✅ Log retention: 7 years configured
   ✅ Tamper protection: Cryptographic chaining active
   ✅ Access monitoring: Real-time anomaly detection
   ✅ Incident response: <15 min average

3. ACCESS VIOLATIONS
   Medium Priority (4):
   - After-hours access: 3 events (all authorized)
   - Unusual access pattern: 1 event (false positive)
   
   High Priority (2):
   - Credential sharing suspected: 1 event (confirmed, disciplined)
   - Impossible travel: 1 event (system error, resolved)

4. USER ACCESS REVIEW
   - Access rights recertified: 100% (all users)
   - Orphaned accounts removed: 3
   - Expired credentials cleaned: 15
   - New access grants: 8 (all approved)

5. SYSTEM AVAILABILITY
   - Uptime: 99.97%
   - Failed log writes: 0
   - Backup success rate: 100%
   - Chain integrity verified: 100%

6. RECOMMENDATIONS
   - None this period

Chain of Custody Log Template:

Evidence ID: AUD-2024-015
Case Number: INV-20240220-001
Evidence Type: Smart lock audit logs
Timeframe: 2024-02-15 00:00 to 2024-02-20 23:59

Collection:
├─ Collected by: John Smith, Security Analyst
├─ Date/Time: 2024-02-21 09:15 EST
├─ Method: Direct database export via admin console
├─ Hash: SHA-256: a3f5b9c2...
├─ File format: JSON + CSV
└─ Storage location: Evidence locker #3, encrypted USB

Transfer Log:
├─ 2024-02-21 14:30 - Transferred to: Jane Doe, Legal Counsel
├─ 2024-02-22 10:00 - Transferred to: External Forensics Lab
├─ 2024-02-25 16:45 - Returned from lab with analysis report
└─ Each transfer logged with signatures and hash verification

Integrity Verification:
├─ Initial hash: a3f5b9c2...
├─ Lab receipt hash: a3f5b9c2... (VERIFIED)
├─ Return hash: a3f5b9c2... (VERIFIED)
└─ Chain integrity: MAINTAINED

Common Questions & Answers:

Q: How do you know these logs haven't been altered?
A: "The system employs cryptographic chaining where each event's
   hash includes the previous event's hash. Any modification breaks
   the chain, which we verify mathematically. Additionally, logs are
   written to WORM storage making deletion impossible."

Q: Could the timestamp be wrong?
A: "The system synchronizes with NTP servers every 15 minutes,
   maintaining accuracy within ±0.1 seconds. Logs include both
   system time and UTC timestamp. We verified NTP sync was active
   during the period in question."

Q: How do you know it was really the defendant who used that badge?
A: "We correlate three independent data sources: (1) badge swipe
   log showing badge number, (2) video surveillance showing face,
   (3) network authentication showing same user ID. All three align
   within 2-second window, probability of coincidence <0.001%."

Q: Could someone have cloned the badge?
A: "Our badges use encrypted RFID with rolling codes. Cloning
   requires physical access for 30+ seconds and specialized
   equipment costing $5000+. Video shows badge was on defendant's
   person continuously. Badge was never reported lost or stolen."

Investigation: Unauthorized Data Access
Primary source: Smart lock audit logs
Secondary sources: Network logs, video, badge system

Correlation Matrix:

Time    | Badge Event      | Video Evidence     | Network Event      | Conclusion
--------|------------------|--------------------|--------------------|------------
22:15   | Swipe: Door 5    | User A visible     | Login: User A      | Confirmed entry
22:17   | -                | User A at terminal | File access        | Normal activity
22:23   | -                | User A leaves desk | -                  | Temporary absence
22:25   | Swipe: Server rm | NOBODY on video    | No login           | ANOMALY!
22:28   | -                | User A returns     | Large upload start | CRITICAL!
22:45   | Swipe: Exit Door | User A visible     | Upload complete    | Confirmed theft

Analysis:
├─ Server room access logged but no video confirmation
├─ Conclusion: Badge was used by someone else (video shows User A elsewhere)
├─ Network upload coincides with server room timeframe
└─ Combined evidence: Accomplice used borrowed/stolen badge

1. Time-based alignment:
   ├─ Synchronize all timestamps to UTC
   ├─ Account for clock drift (±seconds acceptable)
   ├─ Create unified timeline (all sources merged)
   └─ Visual timeline tool (Splunk, Kibana, custom)

2. Entity resolution:
   ├─ Map badge_id → user_id → email → full_name
   ├─ IP address → MAC → port → switch → location
   ├─ Door_id → building → floor → room_number
   └─ Unified entity database (common identifiers)

3. Pattern matching:
   ├─ Access then network activity (typical sequence)
   ├─ Multiple locations simultaneously (impossible travel)
   ├─ Access without video confirmation (badge theft)
   └─ After-hours + large upload (data theft pattern)

Baseline Establishment (30-90 days):

For each user, track:
├─ Typical arrival time: 8:45 AM ± 15 min
├─ Typical departure time: 5:30 PM ± 20 min
├─ Frequently accessed doors: [Door 1, Door 5, Door 12]
├─ Never accessed doors: [Server room, Executive suite]
├─ Weekday pattern: M-F regular, weekends rare (2%)
└─ Access method: Badge 95%, PIN 5%, app 0%

Anomaly Scoring:

Event: Badge swipe at 2:30 AM on Sunday at Server Room
Anomaly score calculation:
├─ Time anomaly: 2:30 AM vs typical 8:45 AM → Score: 85/100
├─ Day anomaly: Sunday vs typical M-F → Score: 90/100
├─ Location anomaly: Server room vs never accessed → Score: 95/100
├─ Combined score: (85 + 90 + 95) / 3 = 90/100
└─ Threshold: 70/100 → ALERT TRIGGERED

Alert priority:
├─ Score 50-69: Low (log only)
├─ Score 70-84: Medium (email to security)
├─ Score 85-94: High (immediate notification)
├─ Score 95-100: Critical (page on-call)

False Positive Reduction:

Initial deployment:
├─ False positive rate: 45%
├─ Alert fatigue: High
└─ Investigation cost: Unsustainable

After 6 months tuning:
├─ Whitelist: Known shift workers (3rd shift = normal)
├─ Context: Project deadlines = expected after-hours
├─ Peer comparison: If 10 users same pattern → probably normal
├─ Temporal: Year-end = higher after-hours (expected)
└─ False positive rate: 18% (60% improvement)

After 12 months + ML:
├─ Supervised learning on labeled incidents
├─ Feature engineering (20+ derived features)
├─ Ensemble model (Random Forest + LSTM)
├─ Continuous retraining (weekly)
└─ False positive rate: 8% (82% improvement from baseline)

Trigger Events (Elevated Monitoring):

Employee gives notice:
├─ Increase alert sensitivity 50%
├─ Monitor all after-hours access
├─ Flag any new door access patterns
├─ Track data uploads >10MB
└─ Duration: Notice period + 30 days post-departure

Disciplinary action:
├─ Real-time monitoring (not batch)
├─ Alert on ANY restricted area access
├─ Require manager approval for after-hours
├─ Video verification mandatory
└─ Duration: 90 days or until resolved

Access request denied:
├─ Monitor attempted access to denied area
├─ Flag excessive failed attempts (>3)
├─ Escalate to security if persists
└─ Duration: 30 days

Layoff/reorganization announcement:
├─ Batch monitoring (affected employees)
├─ Flag unusual access patterns
├─ Restrict sensitive area access
└─ Duration: Announcement + 60 days

Data Theft Indicators:

Pattern 1: "Bulk Download Before Departure"
├─ User gives notice
├─ Access to file servers increases 10×
├─ Large network transfers to personal cloud
├─ After-hours access when building empty
└─ Alert: HIGH - Probable data theft

Pattern 2: "Gradual Exfiltration"
├─ Daily uploads increase from 10MB → 500MB over 3 months
├─ Outside normal work hours (avoids detection)
├─ To external IP addresses (not corporate)
├─ Coincides with LinkedIn activity (job hunting)
└─ Alert: MEDIUM - Monitor closely

Pattern 3: "Physical Media"
├─ Badge access to print room increases
├─ After server room visits (pattern correlation)
├─ Short visits (<5 min) suggest file copying
├─ No network upload detected (offline exfiltration)
└─ Alert: HIGH - Physical media suspected

Response Playbook:
├─ Confirm pattern (review 90-day history)
├─ Verify business justification (check with manager)
├─ If unjustified: Escalate to security immediately
├─ If confirmed theft: Revoke access, involve legal/HR
└─ Document everything for potential prosecution