UBA (User Behavior Analytics)

User Behavior Analytics (UBA) processes authentication, application and access logs to model how each user normally operates — typical login times, locations, applications, file access volumes — and uses statistical and ML methods to score deviations as risk. UBA is particularly effective against threats that bypass signature-based defences: credential theft, insider data theft, account takeover and slow-and-low lateral movement. UBA is usually delivered as a module of a SIEM or identity platform and feeds prioritized alerts to the SOC; in modern deployments it is typically extended to non-human accounts and devices as UEBA.