Business management can intervene if they find suspicious files or user activities. This user and entity behaviour analytics (UEBA), solution applies sophisticated rules-based modeling to the data sources to establish patterns of normal behavior and determine suspicious activities. The analysis can reduce the likelihood of insider threats, as they are difficult for privileged users to detect because they have specific knowledge about security controls and ways to bypass them. Detect anomalous events, such as logins using the user IDs of previous employees, users logging in simultaneously from multiple locations, or unauthorized user retention of sensitive files. Monitor file-based risk, such as unauthorized attempts to decrypt sensitive files. Monitor user-based risk, such as users decrypting files frequently, printing more files after normal business hours, and sending more files to external recipients than usual.