User and Entity Behavior Analytics (UEBA)

Traditional security monitoring relies on rules: “if this event occurs, alert.” This works well for known threats, such as a malware signature, a blocked login attempt, or a transfer to a blacklisted address.

It breaks down for threats that unfold slowly through a series of individually legitimate actions. An employee downloads slightly more files than usual each day for a month. A compromised account logs in from a new location. A contractor accesses systems outside normal hours.

Each action passes the rules. The pattern, meaning the cumulative deviation from the user's normal behavior, is what signals the threat. UEBA is designed to find these behavioral patterns.

UEBA works in five stages, from raw data collected by user activity monitoring to peer comparison.

1. 1

   Data collection

   UEBA consumes activity data from across the environment: logins, file access, application use, data transfers, network connections, and endpoint activity. Richer data makes baselines more accurate.

2. 2

   Baselining

   For each user and entity, the system builds a behavioral profile: usual working hours, applications, data accessed, contacts, and connection sources. The baseline is learned over time and adapts as roles change.

3. 3

   Anomaly detection

   New activity is compared with the baseline. Statistical models and machine learning flag deviations, such as a sudden spike in data volume, access outside the usual scope, unusual hours, or new locations.

4. 4

   Risk scoring

   Instead of binary alerts, UEBA combines several weak signals into one risk score. Working late alone is low risk. Working late, bulk downloads, and uploads to personal cloud storage together are high risk.

5. 5

   Peer-group comparison

   UEBA also compares a user with peers in the same role or department. Behavior that is normal for the team but unusual for one person, or the reverse, adds context.

Many threats involve both. A compromised user account (a user anomaly) can operate from an unusual device (an entity anomaly). UEBA correlates across both dimensions.

• Users are people: employees, contractors, administrators, and service accounts. UEBA tracks their behavior patterns, a core input for any insider risk program.
• Entities are non-human actors: devices, servers, applications, and network nodes. An entity can show unusual traffic, unexpected connections, or configuration changes.

UEBA overlaps with several tools, but each answers a different question.

The risk analysis in Anexet Activity groups incidents by risk category, so an analyst can see which users carry high scores.

1 / 2

• 
• 

Four limits affect results in practice.

Each case relies on the same idea: a personal baseline and a deviation that a single rule would miss, as in insider threat detection.

Further reading: How does a security officer identify an insider using the DLP system?.

• Insider threat detection: spotting employees or contractors whose insider threat indicators suggest data theft, sabotage, or fraud, before or as it happens.
• Compromised account detection: when stolen credentials are used, the activity pattern differs from the legitimate user's baseline.
• Lateral movement detection: attackers moving through the network create access patterns that differ from normal user behavior.
• Privileged account monitoring: administrators have broad access, and UEBA helps detect when it is used unusually.