What is UEBA?
User and entity behavior analytics (UEBA) is a detection approach that learns what normal activity looks like for each user and each entity, such as a host, server, application or service account, and raises alerts when activity departs from it. A single fixed rule, such as alert on any sign-in after 10 p.m., buries analysts in night-shift logons while missing an intruder who keeps office hours. UEBA instead compares each account with its own history and with peers in the same role. The older term, user behavior analytics (UBA), covered only people; the E adds devices and non-human accounts. UEBA is often a module of a SIEM or an identity protection platform.
How UEBA works
- Collect: authentication logs, VPN and proxy records, endpoint telemetry, cloud and SaaS audit logs, and file and database access events.
- Learn: over a training period, often several weeks, build baselines of times, locations, devices, data volumes and resources for each user, entity and peer group, including patterns such as month-end spikes in finance.
- Score: statistical and machine learning models rate how unusual each new event is.
- Aggregate: scores add up into a risk score per user or entity over time, so several small anomalies can produce one meaningful alert.
- Improve: analysts' verdicts on alerts are fed back to refine the model.
What UEBA detects
- Compromised accounts: impossible travel, sign-ins at unusual hours from new devices, access to systems the user has never touched.
- Insider threats: bulk downloads before a resignation date, browsing of data outside the person's role.
- Service account misuse: an account that normally authenticates from one server suddenly logging on interactively somewhere else.
- Lateral movement and exfiltration: one host contacting many peers over SMB or RDP, or uploading large volumes to a new cloud storage destination.
Example: a UEBA risk alert
UEBA risk=91 entity=svc-sqlbackup peer_group=service_accounts anomalies=interactive RDP logon (never seen); source WS-FIN-112 (never seen); 4,800 files read on FS03 (baseline 0)
The service account normally authenticates only from the database server during the nightly backup window. None of the three events would trip a simple rule on its own, but together they suggest stolen service account credentials being used for lateral movement. The analyst disables the account and investigates the finance workstation.
Limits and tuning
New users and new systems have no history, and legitimate change such as a reorganization, a new project or business travel looks anomalous until the model adjusts, so false positives are common early on. If an intruder is already active while the model learns, or ramps up gradually, that behavior gets absorbed into the baseline. Training data matters too: a model that learned from one office or one shift treats everyone else as abnormal, and analysts soon stop reading those alerts. Monitoring employee behavior also raises privacy questions, so the program needs a written policy, notice to staff and involvement from HR and legal.
UEBA vs. SIEM rules and behavior risk scoring
SIEM correlation rules detect patterns someone has already described, such as five failed logons followed by a success. UEBA finds activity that is unusual for one specific account even when no rule describes it, and the two work best together. Anomaly-based network IDS applies a similar baseline idea to traffic rather than identities. Behavior risk scoring in security awareness programs is different again: it rates a person's security habits over months to target training, while UEBA looks for compromise or misuse happening now.
UEBA on the CompTIA Security+ exam
SY0-801 no longer names user behavior analytics as a separate item, but UEBA is taught with SIEMs and alerting under objective 4.4 and under objective 4.6, where AI-augmented baselines that learn each user's and system's normal behavior are the approach UEBA uses. Wording such as baseline normal behavior for each user, detect a compromised account without a known signature, unusual compared with the user's peer group or identify insider threats from behavior points to UEBA. Distractors include signature-based IDS, a static correlation rule, DLP, SOAR, which automates the response rather than detecting, and predictive analysis, which forecasts future risk.