Cortex XDR uses several engines to detect threats, but the one specifically focused on baseline deviations and behavioral anomalies is the Analytics Engine.

Behavioral Baselining: The Analytics Engine uses machine learning to observe the 'normal' behavior of users and devices (e.g., typical login times, usual data transfer volumes, common process executions).

Multi-Event Correlation: Unlike a simple IOC rule that triggers on a single malicious file hash, the Analytics Engine looks at a sequence of events---even if those individual events seem benign---and identifies them as suspicious because they deviate from the established norm.

Difference from Causality Analysis Engine (B): The CAE is used to reconstruct the chain of events (the 'how') after an alert has been triggered, whereas the Analytics Engine is the component that generates the alert based on behavioral logic.