This article discusses using a 3D visualization model called Time-Terrain-Behavior (TTB) to identify unusual workstation behavior in security data. By analyzing patterns without prior knowledge of what to look for, the approach reveals outlier workstations that may indicate compromise. The method is applied to the BOTS v2 dataset for practical validation.