User behavior analytics (UBA) learns what normal activity looks like for each account and flags meaningful deviations, such as a login from a new country or a bulk file download. It helps find stolen credentials and insider misuse that rules written in advance miss, but it needs good logs and tuning.
What does UBA actually measure?
It takes event data from sources like identity providers, VPNs, file servers, cloud audit logs and applications, and builds a profile per user. Typical features include login times, locations, devices, resources touched, volume of data moved and peers who do similar work.
Then it compares new events against that history, and often against peers. The output is a score or an alert saying this activity is unusual for this person. The term UEBA, adding entities, extends the same idea to machines and service accounts.
Why would you need it?
Many attacks use valid credentials. MITRE ATT&CK lists valid accounts as technique T1078, and notes it can serve initial access, persistence and privilege escalation. A stolen password passes every signature check. The only difference is behavior.
NIST SP 800-137 on continuous monitoring describes the aim of maintaining ongoing awareness of security and risk. Behavior baselines are one way to apply that to accounts.
A constructed example. A finance analyst usually opens 20 to 30 files a day from two shared folders, between 9 and 6. On a Saturday at 02:10 the account logs in from a new device, opens 4,000 files across eight folders, and copies them to a personal cloud storage site. A static rule might not exist for this exact pattern. Behavior analysis sees four departures from the baseline at once and raises it.
What are the limits?
False positives. People travel, change roles and work odd hours. A new hire has no baseline at all. Without tuning, analysts drown in alerts and stop trusting the tool.
Data quality. If logs are missing, mislabeled or delayed, the model learns nonsense. Shared accounts break the premise entirely, because one name is many people.
Explainability. "Score 87" is not an answer. Analysts need to see which behaviors changed and by how much, or they cannot decide quickly.
Privacy and governance. Monitoring employee behavior has legal and ethical dimensions that vary by country and contract. Decide with legal and HR what is collected, who sees alerts, and how long data is kept.
UBA or simple rules?
Start simple. Rules like impossible travel, logins after account disable, mass downloads and new admin grants catch a lot at low cost and are easy to explain. Add behavior baselines where rules are too blunt: for high-value roles, sensitive data stores and privileged accounts.
What does a good alert look like?
A useful alert answers four questions in a few seconds: who, what changed, how unusual it is, and what to do next. For the finance analyst above, the alert would name the account, list the new device, the file count and the destination site, show how each compares with the last 90 days, and link to the playbook step that disables the session and calls the user.
If your tool cannot show the underlying events behind a score, treat that as a gap. Analysts need to verify a claim in the raw logs, and auditors will ask how a decision was made. Keep the raw events for at least as long as your investigation window requires.
Also decide in advance what automated action is acceptable. Forcing a password reset on a probable stolen account is low risk. Locking a senior executive out during a deal is not. Match the response to the confidence level, and let a human approve the high impact ones.
How to check or apply this
- Pick three questions you want answered, for example stolen credentials, data hoarding before resignation, and misuse of admin rights.
- Confirm you have logs that answer them, with user identity and timestamps, from the right systems.
- Remove or flag shared accounts.
- Start with a small group, such as privileged users, and review every alert for a month.
- Record why each alert was true or false, and use that to tune.
- Write a response step for each alert type, so a score always leads to an action.
- Agree the privacy rules in writing before launch.
Quick check
Does UBA need machine learning?
Not always. Statistical baselines and peer group comparisons often do the job. Machine learning can add value but makes explanations harder.
What is the difference between UBA and UEBA?
UEBA adds non-human entities such as servers and service accounts to the analysis. The method is the same.
Sources
Last reviewed: 18 October 2026.
