Simulated and real log ingestion (user logins, file access, USB usage, emails) Feature engineering for behavioral, frequency, anomaly, graph, and NLP features Unsupervised anomaly detection (Isolation ...