Administrator accounts generally require enhanced monitoring.
In particular, we can monitor:
- connections
- the schedules
- the machines used
- changes in privileges
- administrative operations
- access to critical systems
Administrative activity from an unusual environment can therefore generate an alert.