Internetten SOC SIEM Use Cases. Unauthorized user access to confidential data. Unauthorized subnet access to confidential data. Unauthorized user on the network “Enable NAC”. Unauthorized device on the network “Enable either NAC or ISE”. Unauthorized server connection to the Internet. Suspicious traffic to known vulnerable host. Logging source stopped logging