Learn about Cloud SIEM's Outlier Rules which allow you to generate a Signal when behavior by an Entity (such as a user) is encountered that deviates from its baseline activity.

To learn more, check out the docs at: https://help.sumologic.com/docs/cse/rules/write-outlier-rule/