Normal user activity vs. suspicious actions. UEBA tools baseline behavior to flag anomalies, like an admin suddenly running PowerShell. It's about context, not just tools. #Cybersecurity #UEBA #ThreatDetection #ITSecurity #Ransomware