What is UEBA (User and Entity Behavior Analytics)?

What is User and Entity Behavior Analytics (UEBA)?

User and Entity Behavior Analytics (UEBA) is a security technique that learns what normal looks like for each user and each entity (a server, service account, device or application), then flags activity that departs from it. It is built for threats that use valid credentials, where every single action is allowed but the pattern is not: an account that suddenly reads data it never touched, at an hour it never works, from a place it never logs in from. UEBA is a security discipline. LoadFocus does not offer it, and this page explains the concept so you can place it next to the tools we do build.

How UEBA works

1. Collect events

UEBA reads logs that already exist: sign-ins, file and database access, network flows, endpoint activity, cloud audit logs, and identity data from your identity and access management system. The richer the sources, the better the picture.

2. Build baselines

For each user and entity the system records typical behavior over a learning period: working hours, locations, devices, systems touched, data volumes. It also builds peer groups, so a finance analyst is compared with other finance analysts and not with the whole company.

3. Score deviations

Each new event is scored against the individual baseline and the peer group, using statistics and often machine learning. One odd event rarely matters. The useful signal is several small oddities stacking up for the same identity in a short window, which raises that identity's risk score and moves it up the analyst queue.

Example

A service account that only ever calls one internal API starts authenticating to a file server and listing hundreds of directories overnight. No rule was broken and the credentials are valid. UEBA flags it because the account has never behaved that way and no account in its peer group does either. An analyst then checks whether a secret leaked, which is the point where incident response begins.

What UEBA is good at

• Compromised credentials: a valid login from an unfamiliar device, place or time.
• Insider misuse: unusual bulk downloads or access to records outside a person's normal work.
• Lateral movement: a compromised account reaching systems it never used before.
• Non-human identities: service accounts, jobs and API keys that suddenly act differently.

NIST describes this use in SP 800-215, where UEBA is named as a way to detect anomalies in users' cloud access behavior and to help stop insider threats and advanced attacks.

UEBA, SIEM and XDR

• SIEM collects and stores logs and applies correlation rules for known patterns.
• UEBA adds behavioral baselines on top of that data to find what no rule describes. It usually sits on a SIEM or ships inside one.
• XDR correlates signals across endpoints, network, email, identity and cloud and can respond automatically. See extended detection and response.

Common mistakes

• Expecting value on day one. Baselines need clean history. A new deployment is noisy until it has learned your normal.
• Feeding it too few sources. Sign-in logs alone miss the data-access and network behavior that makes an anomaly meaningful.
• Never tuning. Risk thresholds and peer groups need ongoing adjustment, or analysts learn to ignore the alerts.
• Treating it as a replacement. UEBA does not replace access control, logging or response processes. It ranks what to look at.
• Ignoring blind spots. Activity on unmanaged devices or in encrypted channels you cannot see cannot be baselined.

UEBA, APIs and where LoadFocus fits

Behavioral analytics applies to API traffic too: unusual request rates, new endpoint sequences, or a key used from a new region. That belongs to API security and to your security tooling. LoadFocus does not provide security analytics, anomaly detection on user behavior or threat detection. What it does provide is synthetic checks: API monitoring measures availability and response times of your endpoints on a schedule, and load testing shows how your services behave under heavy traffic. Both give you a performance baseline to read next to security signals. For the wider picture, see our guide to cloud testing security best practices, and the glossary entry on cyber security threats.

FAQ: User and Entity Behavior Analytics

What is the difference between UEBA and UBA?

UBA analyzes people only. UEBA adds entities such as servers, service accounts, devices and applications. UBA is mostly a legacy term now.

Does UEBA need machine learning?

Not strictly. Statistical baselines and rules can work, and many products combine them with machine learning. Rules are easier to explain in an audit, while machine learning can surface patterns nobody wrote a rule for.

Can UEBA replace a SIEM?

No. A SIEM collects, stores and correlates logs. UEBA reads that data and adds behavioral scoring, so the two work together.

What data does UEBA need?

Authentication logs first, then file and database access, network flow data, endpoint activity, cloud audit logs and identity data. More relevant sources give a better baseline.

Does LoadFocus offer UEBA?

No. LoadFocus is a performance platform for load testing, API monitoring and page speed. It does not analyze user behavior for security threats.