User and entity behavior analytics (UEBA) software is a family of tools used to develop and model baseline behaviors for people and hardware within a network, with the ultimate goal of identifying abnormalities and alerting security staff. These tools leverage machine learning to identify patterns and monitor user or machine behaviors, notifying stakeholders of abnormal activity, malicious behavior, or performance issues that arise from mistakes or improper operational actions.
Companies use UEBA technology to protect their sensitive information and business critical systems from both external and insider threats. These may be employees or partners that partake in nefarious activities such as stealing data, adjusting privileges, or violating company policies. UEBA solutions can also detect compromised accounts that may have resulted from weak passwords or phishing scams that provide network access to unapproved parties. UEBA can uncover a number of external threat types as well; most notably, brute force attacks and privilege escalation.
UEBA functions on a similar basis as risk-based authentication (RBA) software and zero trust networking software. Both of these tools use machine learning to evaluate risk and identify threat actors, but neither is designed to constantly monitor user behavior within a specific network. RBA takes into account variables such as historic access, location, and IP address to determine risk when authenticating. Zero trust network architectures are designed segment networks and monitor network activity. If threats are detected, a segment of the network or an individual endpoint will be restricted from network access.
To qualify for inclusion in the User and Entity Behavior Analytics (UEBA) category, a product must:
Use machine learning to develop baseline behaviors for individual users and resources within a network
Monitor the users and resources with a network for insider threats and other anomalies
Provide incident details and remediation workflows, or integrate with incident response solutions
Integrate with existing security systems to enforce policies and develop automated incident management processes
