You can, the company I work for makes a product that does exactly that. It's very much a last line of defense way of detecting attacks because it means the att

You can, the company I work for makes a product that does exactly that. It's very much a last line of defense way of detecting attacks because it means the attackers are already in and already have access to whatever workload is being protected. https://www.rubrik.com/en/products/polaris-overview/polaris-radar https://www.rubrik.com/en/products/polaris-overview/polaris-... Disclaimer: I'm just an engineer (not a sales person/pr/...) and all my comments on HN including this one are entirely my own views/not the companies views.