What is user and entity behavior analytics (UEBA)?
User and entity behavior analytics (UEBA) is a security technology that learns how users, devices and applications normally behave, then flags activity that departs from that baseline, such as a login from an unusual place or a sudden spike in downloads.
How it works
UEBA usually sits inside or beside a SIEM and feeds alerts to the security operations center. It is strongest at spotting a compromised account or an insider acting out of pattern.
Human risk management uses some of the same data for a different purpose: ranking who is most likely to cause an incident before it happens, and acting to lower that risk.
Why it matters
Behavior is often the first sign that something is wrong. UEBA turns raw logs into a short list of anomalies worth investigating.
