Yes, - the tech is called UBA (user behaviour analytics.. or something) - over time it builds a baseline of what a user does in a typical day/ week/ month as part of their role, and if they deviate from that base pattern then an alert can be triggered on different thresholds - for example, why is a member of support downloading the entire production database (not that they should have access there, but you get my point)