UEBA (User and Entity Behaviour Analytics)

User and entity behaviour analytics is an approach to threat detection that focuses on how users and systems normally behave, and flags departures from that norm. Rather than looking for known-bad signatures, UEBA learns a baseline for each user and entity, such as the hours they usually work, the systems they access, the volume of data they handle, and the locations they connect from, then raises an alert when behaviour deviates in ways that suggest a threat.

The technique addresses threats that signature-based detection handles poorly, chiefly compromised accounts and insider threats. When an attacker steals valid credentials, their logins are technically legitimate and pass authentication, so signature tools see nothing wrong. UEBA can catch them because the stolen account starts behaving abnormally: logging in at an unusual time, from an unfamiliar location, accessing systems it never touches, or moving unusual volumes of data. The same logic detects a malicious or negligent insider whose activity deviates from their own established pattern.

UEBA typically works by collecting activity data from sources such as authentication logs, endpoints, applications and network devices, building statistical and machine-learning models of normal behaviour, and scoring ongoing activity against those models. Higher-risk anomalies, or combinations of several smaller anomalies, generate alerts for analysts to investigate. The entity part of the name is important: it applies not only to human users but also to service accounts, devices and applications, which have behavioural baselines of their own.

The main challenge is the same balance that affects all behavioural detection: sensitivity against noise. People and systems legitimately do unusual things, so a poorly tuned UEBA deployment produces false positives and contributes to alert fatigue. Effective use depends on good data, sensible baselining periods, and analyst feedback that refines the models over time. UEBA is a signal to investigate, not a verdict on its own.

UEBA is rarely a standalone product today; its capabilities are commonly built into security information and event management platforms and extended detection and response tools, where behavioural analytics complements rule-based and intelligence-led detection. Together they give a security operations centre a richer set of ways to catch threats that any single method would miss.

UEBA is rarely purchased as a standalone product today; its analytics are usually built into SIEM and extended detection and response platforms, where behavioural scoring complements rule-based and intelligence-led detection. The combination matters because no single method catches everything: signatures handle known threats, rules encode known-bad patterns, and behavioural analytics surfaces the abnormal activity, such as a compromised account behaving unlike its owner, that the other methods would pass over.

In its managed SOC, Precursor uses behavioural analytics alongside signature and intelligence-led detection, so compromised accounts and insider activity that look legitimate to authentication systems are still caught and investigated.