The aim of the thesis is to map the available sources of security information in information systems and their automated collection and processing. The area of interest is user behavior in the information environment of an organization. Among the available data sources, the main focus is on VPN, SSH and application logs. About user behavior on the network, you will primarily observe users logging in and out of the organization's network and logging in and out of internal systems. The theoretical part will describe the documentation for the technology used, which will include a description of the technology, documentation of the procedure for obtaining information from the technology, and a detailed description and analysis of all the aforementioned information that the technology can provide about the desired situation. The practical part will be the technical implementation of data collection from different data sources, both using existing technologies and creating own tools. Then implement data transformations from source formats into a standardized structured form.