What is User and Entity Behavior Analytics (UEBA)?
User and Entity Behavior Analytics (UEBA) is a security technology that builds baseline behavioral profiles for users, devices, and other entities, then alerts on statistically significant deviations from those baselines. It is used to detect insider threats, compromised accounts, and advanced attacks that evade signature-based controls.
What it does
UEBA tools collect activity data from sources such as identity providers, endpoint logs, cloud applications, and network flows. They apply machine learning models to establish a normal behavior baseline for each user and entity. When observed activity deviates from that baseline, the tool assigns a risk score and raises an alert. Specific detections include:
- Logins at unusual hours or from unusual locations
- Privilege escalation outside normal patterns
- Bulk file downloads or data transfers
- Lateral movement between systems
- New account creation with elevated rights
Risk scores accumulate over time, so a single odd event may not trigger an alert, but a chain of low-confidence signals can cross a threshold and surface an investigation.
Why teams buy it
Signature-based tools miss threats that do not match known attack patterns. A compromised credential, a malicious insider, or a slow-moving advanced persistent threat (APT) can operate entirely within normal-looking traffic. UEBA catches these by comparing behavior to a learned baseline rather than a static rule. Security operations teams use UEBA to prioritize alerts, reduce investigation time, and meet compliance requirements that call for monitoring privileged user activity.
What to look for
- Data source coverage: Can the tool ingest logs from your identity provider, SaaS apps, endpoints, and cloud workloads?
- Baseline tuning period: How long does the model need before it produces reliable scores?
- Risk scoring transparency: Does the tool explain which behaviors contributed to a score, or is it a black box?
- Response automation: Can it trigger account suspension, session termination, or a ticket in your SOAR or ITSM platform?