The Identity Forensics Pilot helps administrators to determine which user behavior is legitimate by analyzing the login events and generating roll-up aggregates of common metrics.