What is baseline behavior in the context of anomaly detection?

• A.The default system configuration, as documented in the vendor's initial setup and installation guide
• B.The minimum security standard that auditors check once a year, as required by the compliance framework and its annual attestation cycle
• C.The base security policy published by the vendor, as a template that IT copies and rarely customizes for the specific environment
• D.Normal patterns of network traffic, user activity, and system behavior used as a reference to identify deviations