User and entity behavior analytics (UEBA) systems monitor an organization’s network, using AI and machine learning (ML) to analyze suspicious activity related to user and endpoint behavior that could indicate a security threat. As modern cyberattacks grow in sophistication, UEBA has become critical for catching the threats that traditional cybersecurity measures miss.
In this article, we'll explore the key concepts and components of UEBA and the benefits and challenges it brings. Let’s begin by examining the core concepts of UEBA more deeply.
UEBA core concepts
UEBA employs ML and data analytics techniques to establish the typical behavior patterns of users and entities in an organization. By establishing this behavioral baseline, UEBA can then detect abnormal patterns of activity in an organization’s systems and networks. These anomalous behaviors might signify threats such as stolen credentials, compromised entities, or insider attacks.
More generally, behavioral analytics refers to the study of repetitive or significant activities. Within the context of cybersecurity, behavioral analytics focuses on understanding how users and entities normally interact with an organization’s systems. The “users” in UEBA may include an organization’s employees, contractors, and even customers. Meanwhile, the “entities” may be anything else that communicates in the network; this could be servers, devices, applications, or more. The inclusion of entities in UEBA is important because cyber threats are not always tied to humans; automated bots or compromised devices can be just as damaging as human attackers.
Practical applications
UEBA has many practical applications within the modern enterprise:
- Network security: Monitoring network activity and resource access by both users and entities to detect vulnerabilities or breaches.
- Detecting insider threats: Identifying abnormal activity from authorized users, indicating the possibility of harmful actions from within your organization.
- Adversary intrusion: Detecting and alerting your team to unusual data access patterns that might indicate adversary intrusion.
Venu Shastri, a seasoned Identity and cybersecurity product marketeer, serves as Director, Product Marketing at CrowdStrike for Unified Endpoint & Identity Protection. With over a decade of experience in identity, driving product marketing and management functions at Okta and Oracle , Venu has a US patent on passwordless authentication. Prior to his identity experience, Venu had co-founded and drove product management for an enterprise social software start-up. Based out of Raleigh, NC, Venu holds an MBA from the University of Santa Clara and Executive Certification from MIT Sloan.
