User and Entity Behaviour Analytics (UEBA) is a security technique that learns what is normal for users and other entities, such as hosts, service accounts and applications, and flags deviations that may signal compromise or misuse. It looks for behaviour that does not fit, instead of matching known signatures.

How does UEBA work?

1. Collect: gather data on authentication, directory changes, applications, networks and endpoints.
2. Baseline: learn normal patterns for each user and entity, and for peer groups.
3. Compare: measure current behaviour against the baseline.
4. Score: judge how unusual each deviation is and how serious it could be.
5. Alert: raise a case, with context, when the combined picture justifies it.

What can UEBA detect?

• Compromised accounts that behave unlike their owners.
• Insider threats and privilege misuse.
• Lateral movement across systems.
• Unusual data access or exports.
• Dormant accounts that suddenly become active.

What is a peer group?

A set of users with similar roles or access. Comparing a person with their peers helps tell what is unusual for them from what is normal for the role.

Why does context matter?

An unusual event is not always malicious. A person on a business trip signs in from a new country. A good analysis combines several signals, such as location, time, system and volume, so that one oddity does not become an alert and several together do.

How is UEBA different from SIEM?

A SIEM collects and correlates logs, mostly with rules. UEBA adds behavioural analytics on top, to find what the rules do not describe. Many SIEM platforms now include UEBA features.

How is UEBA different from ITDR?

UEBA is a technique. ITDR is a discipline that uses behavioural analytics focused on identities, and adds investigation and response, so that a detection leads to action.

What does UEBA look like in practice?

A finance employee normally reads a few reports during the day. One night, their account queries a large number of customer records, from a new location, using a system it has never used. No rule was broken, but the combination stands out against what is normal for that person and their peers.

What data does UEBA use?

• Authentication events and directory changes.
• Application and database activity.
• Cloud and SaaS activity.
• Network and endpoint telemetry.
• Information on roles, groups and peers.

The more complete and consistent the data, the more reliable the baselines.

How does UEBA prioritise risk?

Single signals are weak. A new location alone means little. UEBA combines several signals, such as location, time, system, volume and privilege, into a risk picture. Risk-based prioritisation then puts the most serious cases first.

How do you reduce false positives?

Tune baselines against real activity, add context such as role and peer group, let analysts give feedback on results and keep alerts explainable, so that people can tell quickly why something was flagged.

What are the limits of UEBA?

• It needs time and good data to learn what is normal.
• Poor baselines produce false alarms.
• A deviation is not proof of malice.
• Alerts need to be explainable, or analysts will not trust them.

What about privacy?

Analysing the behaviour of people involves personal data, so it must be proportionate, transparent and designed with data protection in mind. Involve legal, HR and privacy teams from the start.

How do you get value from UEBA?

Start with the most valuable identities and applications. Tune against real activity, and connect detection to investigation and response, so that alerts do not pile up unanswered.

Sharelock uses behavioural analysis of identities, down to individual transactions and queries on critical applications, to flag misuse and then investigate it autonomously within guardrails.

‍