A SOC analyst at a manufacturing firm receives an alert generated by a monitoring platform that has learned the normal behavior of each host over 30 days. The alert fires because one workstation, which typically sends 50 MB per day, transmitted 4 GB of outbound traffic overnight — a deviation from its established baseline rather than a match against any known signature. Which type of security monitoring data triggered this alert?