User and entity behavior analytics (UEBA) is a security technology that builds baselines of normal behaviour for users, hosts and other entities and flags anomalies that may indicate compromise or insider threats.
How UEBA works
UEBA collects data from logs – authentication, VPN, cloud services, endpoints, file access, network traffic – and uses statistics and machine learning to learn what is normal for each user, device, service account or application, and for their peer group. It then scores deviations, for example:
- a login from a new country shortly after a login from the office (“impossible travel”);
- an account accessing far more files or servers than usual;
- a service account suddenly used interactively;
- large downloads or uploads shortly before an employee leaves the company.
Individual anomalies add up to a risk score per entity, so analysts see a prioritised list instead of isolated events. The category was named by Gartner, which extended “user behavior analytics” (UBA) with entities in 2015.
Why UEBA matters
Attackers who use stolen credentials and built-in tools generate no malware alerts – their actions look like normal work. UEBA is designed to spot exactly these cases: compromised accounts, lateral movement, data exfiltration and insider threats. Today it is usually a feature of SIEM and XDR platforms, such as Microsoft Sentinel or Splunk, rather than a separate product. It complements endpoint behavioral analysis with identity and access context.
Its limits are a learning period, sensitivity to organisational changes and false positives when baselines are poor.
How UEBA is used
- Feed it high-quality identity, cloud and endpoint logs.
- Combine risk scores with automated responses, such as forcing MFA or suspending sessions.
- Have the SOC review high-risk entities and tune the models.
