Yes that’s a small part of my job.

I setup monitoring systems, ingest logs and create rules to detect unusual or malicious behaviour.

Then I perform investigations which sometimes turn into forensic investigations, which sometimes results in legal action.