Behavior Analytics in Cybersecurity

Quarterly Security Testing Expert Series - Vol 1/4 2020

Timothy Joseph
Timothy Joseph | March 31, 2021

Main Components of UEBA

Main Components of UEBA
  • 1

    User Monitoring and Data Collection System

    The user and entity activities are monitored for anomalies. Different behavioral factors are analyzed from generally visited websites to typically used applications.

  • 2

    Machine Learning System

    A large amount of data generated by user monitoring systems is used and analyzed by machine learning system to detect anomalies.


Use Cases



Security Information and Event Management (SIEM) tools are also an option for teams looking to understand user behaviors.

The following are the key differences between UEBA and SIEM tools.

Operates in real-time.
Point-in-time analysis of event data.
Machine learning models and algorithms are used to analyze data in real time.
Manual effort is mostly required to analyze the data.
Provides risk scoring that rank the threats efficiently.
Alerts are generated based on events that may or may not be malicious.
Processes huge amounts of structured and unstructured data.
Processes structured logs only.

Sample UEBA Report

Security Events

Risk Levels

  • Medium
  • High

Anomalous Reasons

  • Suspicous Endpoint
  • Unusual User Location
  • Unusual User Login Time
  • Unusual Application Access

Anomalous Activity

Risk Level Timestamp Result User Application Access Device Second Factor
Unusual Application Access

The activity is:
10:39 PM
January 04, 2021
DeniedEndpoint is not Trusted
Python Web SDK (kmb)
> iOS 14.4
Unusual Application Access
08:24 PM
January 04, 2021
DeniedEndpoint is not Trusted
Microsoft OWA 166
> iOS 14.3
Suspicious Endpoint
06:05 PM
January 04, 2021
DeniedEndpoint is not Trusted
Juniper SSL VPN 10
> iOS 13.5

Best Practices

Best Practices
  • Identify the sources of data for user behavior, network flows, and system logs.
  • Enable active directory auditing to track user activity on your systems.
  • Audit the systems with sensitive information.
  • Track details on account creation and account logins.
  • Frequently review account permissions.
  • Provide UBA solution with all the data.
  • Regularly review UBA reports and investigate incidents.
  • Create relevant use cases and use datasets to find security solutions.
  • Utilize tools like Microsoft Advanced Threat Analytics and Incydr.
Have Suggestions?

Have Suggestions?

We would love to hear your feedback, questions, comments and suggestions. This will help us to make us better and more useful next time.
Share your thoughts and ideas at


This publication is for informational purposes only, and nothing contained in it should be considered legal advice. We expressly disclaim any warranty or responsibility for damages arising out of this information and encourage you to consult with legal counsel regarding your specific needs. We do not undertake any duty to update previously posted materials.