Where should the administrator look to determine if this is normal behavior?

The server log shows 25 SSH login sessions per hour. However, it is a large company and the administrator does not know if this is normal behavior or if the network is under attack. Where should the administrator look to determine if this is normal behavior?

A.
Change management

B.
Code review

C.
Baseline reporting

D.
Security policy