I maintain that, from the perspective of a SOC analyst, the difference between an admin doing admin things and an adversary doing adversary things....

Is often just a ticket number.

#YesIActuallyPostedSomethingSecurityRelated.