SCP Exam SC0-402 Topic 1 Question 26 Discussion

You are reviewing the IDS logs and during your analysis you notice a user account that had attempted to log on to your network

ten times one night between 3 and 4 AM. This is quite different from the normal pattern of this user account, as this user is only in the

office from 8AM to 6PM. Had your IDS detected this anomaly, which of the following types of detection best describes this event?