CyberGlossary

Defense & Operations

UEBA (User and Entity Behavior Analytics)

Also known as: User and Entity Behaviour Analytics

Definition

A security analytics approach that profiles normal behaviour of users and entities, then flags statistical deviations that may indicate compromise or insider misuse.

User and Entity Behavior Analytics (UEBA) extends classic User Behavior Analytics by also baselining non-human entities such as servers, service accounts, IoT devices, and applications. The platform ingests authentication logs, EDR telemetry, network flows, and SaaS events, then applies statistics and machine learning to learn what is normal for each identity. Deviations — impossible-travel logins, sudden privilege use, atypical data egress — generate risk scores that feed the SIEM or SOAR. UEBA is especially valuable for detecting compromised credentials, insider threats, and slow-burn attacks that signature-based tools miss.

Examples

  • A finance user suddenly downloads thousands of records at 03:00 from a new country, triggering a high risk score.
  • A service account that normally writes to one database starts enumerating Active Directory and is auto-disabled.

Related terms