Certainly, take a look at ahead of and right after patching. Try to be in the pattern of checking the login/logout situations of users. Typically a place Verify will do. Individually, I just look for anything at all out from the standard. By way of example, a VPN person logging in at two PM from unrecognized IP deal with really should be a red flag