What is User and Entity Behavior Analytics (UEBA)?

User and Entity Behavior Analytics (UEBA) is a type of cyber security solution that uses machine learning (ML), deep learning, and statistical analysis to identify the normal behavior patterns of users and entities (e.g., hosts, applications, network traffic, and data repositories) on corporate networks or computer systems. When anomalies or deviations from those behavior patterns are detected and a risk score passes a designated threshold, a UEBA solution alerts security operations center (SOC) teams on whether a potential threat or cyber-attack is in progress.

UEBA is an essential tool in a modern organization’s cyber security stack, especially as many legacy tools are quickly becoming obsolete. As cyber criminals and hackers become more sophisticated, they can more easily bypass traditional perimeter defense systems such as secure web gateways (SWGs), firewalls, and other intrusion prevention tools.

If you’re unfamiliar with UEBA, this guide is here to help you break it down. Below, we will discuss just what UEBA security is, how it works, the difference between User Behavior Analytics (UBA) and UEBA, and UEBA best practices.

What is UEBA security?

Many legacy cyber security tools identified behavior pattern anomalies or deviations using just statistical analysis and user-defined correlation rules. While these tools are effective at thwarting known threats, they are obsolete when it comes to unknown or zero-day attacks and insider threats. With UEBA security, however, SOC teams can automatically detect unordinary behaviors across entire corporate networks or computer systems without relying on user-defined rules or patterns.

UEBA combines the power of ML, deep learning, and statistical analysis to provide SOC teams with more comprehensive threat detection software—allowing organizations to automatically detect complex attacks across multiple users and entities. In addition, a UEBA solution can group together data in logs and reports, as well as analyze information in files and packets.

---

How does UEBA security work?

UEBA works by collecting information about normal user and entity behavior patterns from system logs. Then, it applies intelligent statistical analysis methods to interpret each dataset and establish baselines of these behavior patterns. Establishing behavior pattern baselines is key to UEBA, as this allows the system to detect potential cyber-attacks or threats.

With a UEBA solution, current user and entity behaviors are continuously compared to their individual baselines. The UEBA cyber threat intelligence software then calculates risk scores and identifies if any behavior pattern anomalies or deviations are risky. If a risk score surpasses a certain limit, the UEBA system will alert SOC team members.

For example, if a user regularly downloads 5 MB of files each day and then suddenly begins to download gigabytes worth of files, a UEBA solution would identify this user behavior pattern deviation and alert IT of a possible security threat.

According to Gartner, a UEBA solution is defined by three core attributes:

1. Use cases: A UEBA solution should be able to analyze, detect, report on, and monitor behavior patterns for both users and entities. And, unlike point solutions of the past, UEBA should focus on multiple use cases rather than only focus on specialized analysis—such as trusted host monitoring or fraud detection.
2. Analytics: A UEBA solution should offer advanced analytics capabilities that can detect behavior pattern anomalies using several analytics approaches in a single package. These include statistical models and machine learning (ML), as well as rules and signatures.
3. Data sources: A UEBA solution should be able to ingest data from user and entity activities both natively from the data sources or through an existing data repository (e.g., Security Information and Event Management (SIEM), data warehouse, or a data lake).

---

Differences between UBA tools and UEBA tools

Defined by Gartner, User Behavior Analytics (UBA) was the precursor to UEBA—as it was a cybersecurity tool that strictly analyzed user behavior patterns on networks or computer systems. While UBA solutions still applied advanced analytics to identify behavior pattern anomalies, they were unable to analyze other entities—such as routers, servers, and endpoints.

Gartner later updated the definition of UBA and created UEBA—which included the behavioral analysis of both users and entities (either individually or in peer groups). UEBA solutions are more powerful than UBA solutions, as they use ML and deep learning to recognize complex attacks—such as insider threats (e.g., data exfiltration), advanced persistent threats, or zero-day attacks—across individuals, devices, and networks (including cloud-based networks) rather than relying on user-defined correlation rules.

---

UEBA best practices

As a rule of thumb, UEBA tools should not replace pre-existing cyber security tools or monitoring systems, such as CASBs or Intrusion Detection Systems (IDS). Instead, UEBA should be incorporated into your overall security stack to enhance your organization's overarching security posture. Other UEBA best practices include:

• Ensure only designated IT members receive UEBA system alerts.
• Consider both privileged and unprivileged user accounts as potentially risky.
• Create new policies and rules with both internal and external threats in mind.
• Combine UEBA with big data security analytics like SIEMs to make them more effective at detecting and analyzing complex or unknown threats.

---

Deploy UEBA with CyberRes Arcsight Intelligence

When it comes to advanced User and Entity Behavior Analytics, CyberRes (a Micro Focus line of business) Arcsight Intelligence can help your organization stay protected against complex cyber threats. Providing a contextualized view of both user and entity behavior patterns within your enterprise, our supercharged UEBA tool provides your SOC team with comprehensive tools to visualize and investigate threats—such as insider threats and APTs—before it’s too late.

---

Stopping insider threats w/ ArcSight behavioral analytics

In addition, our anomaly detection models don’t expect the same behavior patterns from every user or entity—which means you won’t have to deal with a flood of false-positive alerts. Using ArcSight Intelligence, our software establishes a clear delineation between unusual behavior and real threats by utilizing mathematical probability and unsupervised ML to identify cyber threats more accurately.

If you’re ready to see how ArcSight Intelligence utilizes a UEBA solution to help your SOC team quickly uncover hidden threats in your enterprise network, feel free to request a demo today.