A threat hunter creates a model of normal, expected activity on a portion of their network. Later, they compare observed activity against this model, looking fo...