What is UEBA?

UEBA moves detection from event-based rules (if X happens, alert) to profile-based anomaly detection (if X deviates significantly from this entity's established normal, alert). This catches attacks that generate no single rule-triggering event on their own: a legitimate account gradually accumulating access to sensitive file shares over weeks, a service account suddenly authenticating from a new geographic location, or an employee accessing systems well outside normal working hours in the days before a resignation. None of these individually looks malicious against a static rule set, but each is a clear deviation from that specific entity's baseline.

UEBA platforms ingest a wide range of telemetry to build multi-dimensional profiles: authentication logs (login times, source locations, MFA challenge patterns), VPN records, endpoint activity, file access and data movement events, badge or physical access systems where available, and email systems. Each entity, human user, service account, or even a device, gets its own baseline built from weeks of historical behavior, and a risk score updates continuously as new events arrive, typically combining multiple weak anomaly signals into one aggregate score rather than alerting on any single deviation in isolation. A user logging in from a new city scores as a minor anomaly on its own; that same login followed by access to a file share they've never touched and a large outbound data transfer compounds into a high-risk score that surfaces for analyst review.

UEBA is particularly effective against two attack categories that evade signature-based detection almost entirely: compromised privileged accounts, where the attacker is using completely legitimate, valid credentials and so triggers no malware or exploit signature, and genuine insider threats, where the actor is an authorized employee whose actions are individually permitted but collectively anomalous. Most modern SIEM platforms now bundle UEBA capability directly, Splunk UEBA, Microsoft Sentinel's UEBA module, IBM QRadar, rather than requiring a separate standalone product, which lets the risk scoring correlate directly against the same log data the SIEM already ingests.