Simple definition
UEBA is a concept or mechanism used in cybersecurity to detect user or entity behavior anomalies.
Technical definition
In a business environment, UEBA mainly intervenes to detect anomalies of user behaviour or entity. Its implementation depends on the architecture, equipment and security policies in place.
What’s the point?…
detect user or entity behavior anomalies.
Concrete example
an unusual connection combined with a massive transfer increases the risk.
Common problems
- insufficient profile
- false positive
- missing data
To be noted: Always adapt the diagnosis to the version of the product and to the architecture actually deployed.