Roles Activated Too Frequently — Detection Rule

Identifies when the same privilege role has multiple activations by the same user.

Read the full analysis on IntelFusions