Detects unusual or risky user behaviour in Moodle — such as failed logins, impossible travel, unusual login hours, or rapid activity bursts — and triggers automated mitigation actions (e.g. suspend account, kill sessions, notify admins).