Detection & response
UEBA
User and Entity Behaviour Analytics
Analytics that baseline normal behaviour for users, hosts and service accounts and flag statistically unusual activity.
UEBA builds per-entity and peer-group baselines (usual login hours and countries, typical data volumes, normal hosts accessed) and scores deviations: a finance user downloading 50 times their usual volume, a service account logging in interactively, first access to a sensitive share.
It targets threats that signatures miss, such as insider misuse and valid stolen credentials. The weakness is precision: anomalies are not attacks, and new projects, travel and reorganisations all look unusual. Use UEBA scores to prioritise and enrich alerts or drive hunts, rather than paging on every anomaly.