An elections clerk identity that never touched the elections file server suddenly accessed it and then created a mailbox forwarding rule. Which hunt technique describes that sequence?

Behavioral analytics hunting looks for sequences of actions that are abnormal for an identity or asset, not a single indicator match. An elections clerk who never accessed the elections file server, then did, then created a forwarding rule is that pattern. Indicator hunting would start from a hash or domain; configuration hunting would look at host settings such as patches. Exporting mail to Excel is not a Splunk hunt technique and drops the sequence context ES and CIM can preserve.