Analysis of the security logs can detect patterns of suspicious behavior, allowing the administrator to take action.