UEBA Behavioral Baseline: Peer-Group Anomaly Scoring

User and Entity Behavior Analytics (UEBA) platforms don't look for known attack signatures — they learn what "normal" looks like for each peer group and flag statistical deviation from it. This simulator renders a live population of employees as points in a 3D behavioral feature space (after-hours access, data-egress volume, distinct systems touched), draws each department's learned baseline as a covariance ellipsoid, and computes a real-time Mahalanobis-style risk score per entity. Inject a synthetic insider-threat drift into any employee and watch their risk score climb past the alert threshold exactly as it would inside a production UEBA detector.