Monitor and alert on the activity of users that meet the set thresholds of certain activities. For example, if there is a threshold for the number of passwords accessed in an hour or a day to make sure that nobody is harvesting passwords, whether an insider threat or if a bad actor has gained access to an account.