It’s watching the system for events like “file was opened” and “process started”, and looking for patterns resembling hackers/malware. It’s different from AV i

It’s watching the system for events like “file was opened” and “process started”, and looking for patterns resembling hackers/malware. It’s different from AV in that it mostly looks at runtime behavior and not signatures.