Security analysts want to track potential user behavior anomalies over time.

Option D is correct because behavioral anomaly detection requires a persistent baseline of normal user activity and a repeatable method for measuring departures from that baseline. Automated playbooks can continuously collect authentication, endpoint, network, and application events, calculate deviations such as unusual login times, abnormal resource access, or atypical transaction volume, and escalate activity that exceeds defined thresholds. Standard-deviation-based comparison is broader and more defensible than searching for a username or checking a single data source. Option A provides only a permissions comparison at one point in time; it does not establish how the user normally behaves. Option B searches log occurrences but lacks behavioral context, trend analysis, and reliable anomaly scoring. Option C observes only browser activity and therefore misses anomalies in identity, host, cloud, and business systems. A mature implementation should tune baselines, account for role and seasonality, and retain analyst review so legitimate changes are not treated as malicious. This aligns with AI-assisted security concepts involving user and entity behavior analytics, automated enrichment, and risk-based triage.

================