Detect allows you to continuously monitor high-value security metric data reported by your devices (e.g., the number of listening TCP/IP ports on your devices or list of IPs the device is communicating with) and the cloud (e.g., authorization failure count). When you use Rules Detect, the metric data is continuously evaluated against user-defined behaviors; when you use ML Detect, the metric data is continuously evaluated by automatically built machine-learning models to identify anomalies.