A security team wants a system that learns each user's and host's normal activity patterns and flags deviations, such as unusual login times or data volumes, instead of relying on fixed thresholds. Which capability BEST matches this description?

AI-augmented baselines use machine learning to model typical behavior for each entity, such as a user, host, or service, across dimensions like login times, locations, data volumes, and process activity. Once the baseline is established, activity that deviates significantly is flagged for investigation. Because the baseline is learned per entity and adapts over time, it can detect subtle anomalies that a single fixed threshold would either miss or over-alert on, supporting the intended outcome of increased proactivity. Static threshold alerts fire when a value crosses a configured number; they apply the same limit to everyone and do not learn individual patterns, which the scenario explicitly wants to move beyond. Signature-based antivirus identifies known malicious files by patterns; it does not model user or host behavior and cannot flag an unusual login time. A chatbot answering questions about closed incidents helps analysts retrieve knowledge but performs no behavioral detection. Exam caveat: learned baselines can absorb malicious activity that was present during training, and they produce false positives during legitimate changes, so tuning and human review remain necessary. Operational check: review the baseline period for known incidents before enabling alerts, then validate a sample of flagged deviations with system owners.