Roles Are Not Being Used — Detection Rule

Identifies when a user has been assigned a privilege role and are not using that role.

Read the full analysis on IntelFusions