For example, a simple search that uncovers a particular IP address logging into a system can oftentimes detect insider threats because it offers insight into a pattern of behavior of who is using a specific login to access many different types of information.