I'm a bit astonished that LinkedIn's IT[0] needed the FBI to figure out that the person had a unique useragent. And that they don't have alerts for unknown IPs SSH'ing into their server.
[0] though this is before Microsoft acquiring them, so it was probably just the usual startup reckless abandon.
I just read the LinkedIn Incident [1] from the Darknet Diaries, and it's scary how the FBI managed to get all that information about the Russian hacker.
[1] https://darknetdiaries.com/transcript/86/