Automated Breach Response
The GDPR mandates a 72-hour notification window from the moment you become aware of a breach. Manual log reviewing doesn't scale.
Intrusion Detection
You need automated alerting on abnormal data egress. If a service account normally pulls 10MB of data daily and suddenly requests 4GB, kill the token.
| Metric | Anomaly Threshold | Action |
|---|---|---|
| Database Rows Read | > 500% of 7-day trailing average | Revoke DB credentials, page on-call. |
| Failed Logins | > 50 per minute per IP | WAF block IP, rate limit. |