User and Entity Behavior Analytics
UEBA tools build baselines of normal behavior for users, hosts, and service accounts, then flag deviations like a login from a strange country or a sudden mass download. SOC teams use it to catch insider threats and compromised accounts that rule-based detection misses. It matters because stolen credentials look legitimate, and behavior is often the only tell.