This analyses behaviours, patterns and movements related to an entity such as your corporate network. Over time, this pattern becomes established and so any deviation is flagged up as a possible breach.