User and entity behavior analytics (UEBA)

User and entity behavior analytics (UEBA) builds a statistical baseline of normal behavior for each user, device, or service account, logins, file access, data transfer volumes, and flags activity that deviates significantly from that baseline as potentially malicious, even when no known indicator of compromise is present. It typically layers on top of, or feeds into, a SIEM.

UEBA differs from rule-based detection in that it does not require an analyst to predict the exact pattern an attack will take; instead it asks whether this user or entity is behaving unlike its own history and its peers. This makes it well suited to catching compromised credentials and insider threats, where the attacker uses legitimate access rather than malware an endpoint detection and response tool would flag.

UEBA matters because credential-based attacks, where an adversary logs in rather than breaks in, often produce no signature-based alert at all. The common pitfall is a long baselining period during which the model has not yet learned normal behavior, producing either too many false positives or missed detections, so deployments need enough historical data and tuning before analysts can trust the output.