UEBA, user and entity behavior analytics, learns what normal looks like for each account, device and service, then scores deviations from that baseline. It aims to catch what rules miss, such as a valid login that behaves wrongly. It depends on good logs, a tuning process and people who investigate the alerts.
What problem does it solve?
Many attacks use legitimate credentials and tools, so nothing looks malicious on its own. MITRE ATT&CK describes how adversaries abuse existing accounts for access and persistence. A rule that says "alert on a known bad file" will not fire. A rule that says "alert on any login from a new country" fires constantly for travelers. UEBA tries to sit between them by comparing an entity with its own history and its peers.
The control language is in NIST SP 800-53's SI-4 System Monitoring, which asks organizations to detect attacks and indicators of potential attacks and unauthorized connections, analyze detected events and anomalies, and adjust monitoring when risk changes. Among its enhancements are analyzing communications traffic anomalies and monitoring privileged users. UEBA is one way to meet that intent.
How does it work?
Collect. Logs from identity providers, endpoints, cloud services, VPNs, applications and data stores.
Baseline. For each user and entity, learn typical hours, locations, systems accessed, data volumes and peers. Entities include non-human things: servers, service accounts, applications, devices.
Score. Compare new activity to the baseline and to similar entities. Techniques range from statistical thresholds to machine learning models.
Alert and prioritize. Combine signals into a risk score so one odd event does not page anyone but several together do.
Investigate and feed back. Analysts mark alerts as real or benign so the system and the rules improve.
What does it look like? A constructed example
A finance analyst normally opens three applications during business hours from one city and downloads a few reports a day. One night her account logs in from a new device, accesses a code repository she has never touched, and downloads 4,000 files from a file share. Each event alone might be benign. Together they are far outside her baseline and outside her peers' behavior, so the score is high. A responder checks, finds the session token was stolen, and revokes it.
The same data could be explained innocently: a manager asked her to pull a one-off archive from a borrowed laptop. That is why the alert opens an investigation and does not close an account automatically.
What are the limits?
- Data quality. Missing or inconsistent logs produce a bad baseline.
- False positives. New hires, role changes and seasonal work all look odd. Without tuning, analysts learn to ignore it.
- Slow poisoning. An attacker who changes behavior gradually can shift the baseline.
- Privacy. Behavior monitoring of employees raises legal and works council questions. CISA's insider threat guidance notes that observing concerning behavior takes both human and technological elements and that assessment aims to prevent incidents, not punish. Involve legal and HR.
- Explainability. An analyst needs to know why something was flagged.
UEBA does not replace prevention. It supplements multi-factor authentication, least privilege and patching, and it needs a process to respond.
How to check or apply this
- Decide the use cases first: compromised accounts, insider data theft, abused service accounts.
- Confirm you collect the logs those cases need, with reliable user identifiers and timestamps.
- Start with a few high value entities, such as administrators and service accounts.
- Run in monitor-only mode for weeks, review the alerts and tune.
- Agree on a response playbook before turning on automatic actions.
- Review privacy and employment rules with counsel, and document the purpose.
Quick check
Is UEBA the same as a SIEM?
No. A SIEM collects and correlates logs and runs rules. UEBA adds behavioral baselines and scoring, and is often part of or alongside a SIEM.
Does UEBA need machine learning?
Not strictly. Some implementations use statistics and peer group comparisons. Ask how a given tool scores and whether you can see the reasons.
Sources
- NIST SP 800-53 Rev. 5, SI-4 System Monitoring
- MITRE ATT&CK T1078, Valid Accounts
- CISA, Insider Threat Mitigation
Last reviewed: 18 October 2026.
