User and entity behavior analytics (UEBA) is a method for detecting potential threats from network inconsistencies. UEBA tools employ machine learning and AI to establish a baseline for device and user behavior on a network and monitor it for suspicious anomalies.

UEBA Benefits

How UEBA Works

UEBA offers security insights by using machine learning and data analytics to analyze large volumes of data from different sources. This establishes a baseline of normal user behavior, which UEBA monitors to detect any deviations from the norm.

Data is sourced from security tools, threat intelligence feeds, authentication databases, network equipment, and ERP/HR systems. Behavior deviations are scored on a risk level to rank the severity of threats. The scoring metrics help avoid false positives, identify threats, and propose solutions.

UEBA Use Cases

UEBA use cases are divided into two; tactical and strategic use cases.

Tactical Use Cases

Strategic Use Cases


UEBA and UBA differ because UEBA is more advanced and includes entities (E) for monitoring nonhuman activities and machine models such as servers. Both entity and user activity are interconnected since they’re linked to machine entities such as routers. The E was introduced to achieve a more sophisticated and holistic approach to threat identification.

UEBA Analytics Methods

Some UEBA solutions use traditional methods to detect abnormalities. Such methods include known attack patterns, manually-defined rules, and relationships between security events. Traditional methods are deterministic and cannot identify new types of threats hence, modern techniques are helpful: