Build a lightweight behavioral anomaly detection layer on top of existing audit logs to catch suspicious logins, rapid ...