UEBA rules in a SIEM system
Using anomalies in the behavior of users, devices, applications, and other entities to detect cyberthreats.
