UEBA (User and Entity Behaviour Analytics) uses machine learning to establish baselines of normal behaviour for users and entities, such as servers, applications, and service accounts, then flags anomalies that may indicate threats like insider attacks, compromised accounts, or data exfiltration. Unlike rule-based detection systems that require predefined patterns, UEBA identifies threats by detecting deviations from established behavioural norms, making it particularly effective against attacks that use legitimate credentials and blend with normal activity.
This guide explains how UEBA works, what it can detect, how it differs from SIEM, and why many organisations are moving towards integrated platforms that embed behaviour analytics within a broader detection engine rather than deploying standalone UEBA tools.
How Does UEBA Work?
UEBA operates through a multi-stage process that transforms raw activity data into risk-scored anomaly alerts.
Baseline Learning Period
When first deployed, a UEBA system enters a learning phase, typically 14 to 30 days, during which it observes and records patterns of normal behaviour for each user and entity in the environment. The system ingests data from multiple sources: authentication logs, application access records, file activity, network connections, email metadata, VPN sessions, and cloud platform events.
During the learning period, the system builds individual behavioural profiles. For a user, this profile might include: typical login times (08:30-18:00 weekdays), usual source locations (London office, home IP range), regularly accessed applications (Salesforce, SharePoint, Jira), normal data transfer volumes (average 50 MB/day outbound), and peer group behaviour patterns (other users in the same department).
For an entity such as a service account, the profile captures: expected source hosts, typical authentication frequency, accessed resources, time-of-day patterns, and data volume baselines.
Statistical Modelling
UEBA systems employ multiple statistical and machine learning techniques to model behaviour:
- Clustering algorithms group users with similar behaviour patterns (peer groups). An anomaly for one group may be normal for another, a software engineer accessing code repositories at midnight is less unusual than a receptionist doing the same.
- Time-series analysis models temporal patterns, identifying when behaviour deviates from an individual's historical norms. A user who always works 09:00-17:30 suddenly logging in at 03:00 generates a time-based anomaly.
- Frequency analysis establishes baselines for event rates, login frequency, data access volume, application usage counts, and flags statistically significant deviations.
- Graph analysis models relationships between entities (user-to-device, user-to-application, device-to-device) and detects new or unusual relationship patterns.
Anomaly Scoring
Rather than generating binary alerts (threat/not-threat), UEBA assigns anomaly scores to individual events based on how far they deviate from the established baseline. A user logging in one hour earlier than usual might score a 10 (minor deviation). The same user logging in from a country they have never visited, using a new device, at 03:00, and immediately accessing a sensitive file share might score 95 (extreme deviation).
Risk Aggregation
Individual anomaly scores are aggregated into cumulative risk scores per user or entity. This aggregation is critical because no single anomalous event is typically sufficient to indicate a threat. It is the accumulation of multiple anomalies, a pattern of unusual behaviour across different dimensions, that signals a genuine security concern.
For example, a user's risk score might increase incrementally over several days as the system observes: login from a new location (+15), access to a file share outside their normal scope (+20), VPN connection at an unusual hour (+10), and a large file download (+25). The individual events are ambiguous, but the cumulative score of 70 triggers an alert for analyst investigation.
What Can UEBA Detect?
UEBA's behavioural approach makes it effective against a range of threats that are difficult for rule-based systems to detect.
Compromised Accounts
When an attacker gains access to a legitimate user's credentials, their behaviour on the network will differ from the real user's established patterns. The attacker accesses different resources, operates at different times, connects from different locations, and generates different traffic patterns. UEBA detects these deviations even though every individual action uses valid credentials and legitimate access paths.
Insider Threats
Malicious insiders already have legitimate access, making them invisible to perimeter defences. However, the preparatory behaviour for data theft, accessing files outside normal job scope, downloading unusual volumes of data, emailing documents to personal accounts, creates detectable behavioural anomalies. UEBA is particularly effective at detecting the slow, gradual data exfiltration patterns that sophisticated insiders use to avoid triggering volume-based alerts.
Lateral Movement
As attackers move through a network post-compromise, they create authentication events, network connections, and resource access patterns that differ from normal inter-system communication. UEBA detects lateral movement by identifying unusual system-to-system relationships: a workstation connecting to a server it has never accessed, or a service account authenticating from an unexpected host.
Privilege Escalation
When users or attackers obtain elevated privileges, the resulting access patterns diverge from their historical baseline. UEBA detects privilege escalation indicators such as access to administrative tools, interaction with security-sensitive systems, or changes to group memberships that represent behavioural departures.
Data Exfiltration
Data exfiltration, whether via email, cloud uploads, USB devices, or network transfers, generates measurable deviations in data movement patterns. UEBA baselines normal data transfer volumes per user and per system, then flags transfers that are statistically anomalous in size, destination, timing, or frequency.
Service Account Abuse
Service accounts are prime targets for attackers because they often have elevated privileges and their activity is rarely reviewed by human operators. UEBA establishes precise behavioural profiles for service accounts (which tend to be highly predictable) and detects any deviation: an interactive logon, authentication from a new host, or access to a resource outside the account's normal scope.
How Does UEBA Differ from SIEM?
UEBA and SIEM address different aspects of the detection problem. Understanding their relationship, and their respective limitations, is essential for building an effective security monitoring strategy.
| Aspect | SIEM | UEBA | |---|---|---| | Detection approach | Rule-based correlation: predefined patterns | Behaviour-based anomaly detection: deviations from baselines | | What it catches | Known-bad patterns (known TTPs, known IOCs) | Unknown-abnormal behaviour (novel threats, insider activity) | | Setup requirement | Correlation rules must be written and maintained | Learning period required to build baselines (14-30 days) | | False positive profile | High, rules lack contextual understanding | Moderate, baselines provide individual context, but anomalies are not always threats | | Scalability | Scales with data volume (and cost scales with it) | Scales with number of users/entities being modelled | | Maintenance | Rules require continuous updates for new threats | Models update automatically as behaviour evolves | | Blind spots | Cannot detect threats that match no existing rule | Cannot detect threats that do not create behavioural anomalies |
SIEM excels at detecting known attack patterns, a specific sequence of events that matches a predefined rule. But SIEM cannot detect threats that no one has written a rule for, and maintaining thorough rule sets requires significant ongoing engineering effort.
UEBA excels at detecting unknown threats that manifest as behavioural anomalies: compromised accounts, insider threats, and novel attack techniques. But UEBA cannot detect threats that do not create anomalous behaviour (an attacker who perfectly mimics the compromised user's normal patterns), and it requires a baseline period before it becomes effective.
These two approaches are inherently complementary. SIEM catches what you know to look for. UEBA catches what you did not know to look for. This is why the market has converged: standalone SIEM and standalone UEBA are increasingly being replaced by unified platforms that combine both approaches. For a deeper exploration of SIEM capabilities and limitations, see our guide to What Is SIEM.
What Are the Key UEBA Use Cases?
1. Detecting Compromised Credentials
Compromised credentials are the most common initial access vector in cyberattacks, and they are inherently invisible to perimeter defences because the attacker is using a valid identity. UEBA detects compromised credentials through several behavioural indicators:
- Impossible travel: The same account authenticating from London at 09:00 and from Singapore at 09:15: physically impossible, therefore indicating that at least one session is not the legitimate user
- Unusual access patterns: The account accessing resources it has never interacted with before, or accessing familiar resources in unusual sequences
- Device anomalies: Authentication from a device type, operating system, or browser that differs from the user's established profile
- Authentication anomalies: Changes in authentication behaviour such as switching from SSO to direct login, or using NTLM where the user normally authenticates via Kerberos
2. Insider Threat Detection
Insider threats are uniquely difficult because the adversary has legitimate access and often intimate knowledge of the organisation's security controls. UEBA provides the behavioural lens needed to detect insider activity.
Key detection scenarios include:
- Abnormal data access volumes: A user who normally accesses 10-20 files per day suddenly accessing 500 files over a weekend
- Off-hours activity: Sustained work activity during nights and weekends from a user with no history of such patterns, particularly when combined with other indicators
- Scope expansion: Accessing systems, applications, or data repositories outside the user's normal job function
- Resignation risk: Elevated monitoring sensitivity during the period between resignation notice and departure date, when data exfiltration risk is statistically highest
For a detailed catalogue of insider threat indicators, see our guide on Insider Threat Indicators. For tooling comparisons, see 6 Best Insider Threat Detection Tools.
3. Privileged Account Monitoring
Privileged accounts, domain administrators, root users, database administrators, have the access needed to cause catastrophic damage. UEBA provides continuous monitoring of privileged account behaviour:
- Service account drift: A service account that normally authenticates from three specific hosts and accesses two specific databases suddenly appearing on a fourth host or querying a new database
- Administrative account anomalies: An admin account used for interactive web browsing or email access (indicating the account is being used for non-administrative purposes, against policy)
- Privilege accumulation: A user account gradually accumulating group memberships and access rights beyond what is required for their role
4. Data Exfiltration Detection
UEBA baselines normal data movement patterns and detects anomalies that may indicate exfiltration:
- Unusual upload volumes: A user uploading 2 GB to a cloud storage service when their historical baseline is 50 MB per day
- New exfiltration channels: Data transfer via a protocol or destination that the user has never used: a sudden interest in personal email forwarding, or the first-ever USB device insertion
- Access to sensitive repositories: A user accessing code repositories, financial databases, or customer records outside their established access pattern, followed by data transfer activity
- Staging behaviour: The creation of archive files (.zip, .rar, .7z) containing documents from multiple sources, a common preparatory step before bulk exfiltration
What Are the Challenges with Standalone UEBA?
Despite its powerful detection capabilities, standalone UEBA products, deployed as separate tools alongside existing SIEM, EDR, and NDR solutions, face several operational challenges.
Long Baseline Periods
UEBA requires a learning period of 14 to 30 days (and sometimes longer) before it can reliably detect anomalies. During this period, the system is effectively blind. For new employees, new systems, or recently reorganised teams, baseline accuracy may not reach acceptable levels for 60 to 90 days. Attackers who compromise an account during or immediately after the baseline period may escape detection because the system has not yet established a strong behavioural profile.
Context-Dependent Thresholds
What constitutes anomalous behaviour varies enormously by role, department, season, and business context. A finance team working late during quarter-end reporting is normal. The same behaviour in July is anomalous. A marketing team accessing customer databases during a campaign launch is expected. The same access at other times is suspicious. Standalone UEBA systems often lack the business context needed to calibrate thresholds accurately, resulting in alerts that are technically anomalous but operationally benign.
High False Positives Without Signal Correlation
The fundamental limitation of standalone UEBA is that anomalous behaviour is not the same as malicious behaviour. People change their routines, take on new projects, travel for business, and work unusual hours for legitimate reasons. Without the ability to correlate behavioural anomalies with other security signals, endpoint telemetry, network indicators, threat intelligence, UEBA generates a significant volume of false positives that burden analysts.
A standalone UEBA tool might alert on a user logging in from a new location. A correlated platform would see the same login and simultaneously verify that the user's endpoint is running expected software, the network traffic patterns are normal, and no credential-access indicators preceded the login, and suppress the alert as benign travel.
Integration Overhead
Standalone UEBA products require data feeds from multiple sources: Active Directory, cloud identity providers, VPN concentrators, application logs, endpoint telemetry, and network metadata. Building and maintaining these integrations is a significant engineering effort. Data quality issues, inconsistent timestamps, missing fields, format changes, directly degrade UEBA model accuracy.
Alert Actionability
UEBA alerts often lack the context analysts need to investigate efficiently. A UEBA alert might state: "User X anomaly score 85, unusual login location and access pattern." But the analyst needs to know: What was the user doing before and after? What processes were running on the endpoint? Were there any network indicators of compromise? Without integrated endpoint and network context, analysts must manually pivot across multiple tools to investigate each alert.
How Does SenseOn Integrate UEBA?
SenseOn takes a different approach to behaviour analytics. Rather than deploying UEBA as a standalone tool that ingests logs from other systems, SenseOn's cross-domain correlation incorporates unsupervised learning, the core technology behind UEBA, directly into the detection engine alongside supervised learning and deep learning.
Built-In, Not Bolted On
SenseOn's unsupervised learning algorithms perform the same behavioural baselining and anomaly detection functions as dedicated UEBA products. They build per-user and per-entity behavioural profiles across authentication patterns, data access volumes, application usage, network connections, and temporal activity patterns. But because these algorithms operate on telemetry collected natively by the SenseOn agent, not ingested from external log sources, the data is richer, more consistent, and lower latency.
Cross-Validation Reduces False Positives
The key advantage of integrated UEBA is cross-validation. When unsupervised learning detects a behavioural anomaly, it is immediately cross-validated against:
- Supervised learning models: Does the anomalous behaviour match any known attack patterns or threat intelligence indicators?
- Deep learning models: Does the sequence of events leading up to and following the anomaly resemble a known attack chain?
- Endpoint telemetry: Is there any suspicious process activity, file modification, or registry change on the user's endpoint that corroborates the behavioural anomaly?
- Network telemetry: Are there unusual network connections, data transfers, or communication patterns that support the hypothesis of a genuine threat?
This cross-validation dramatically reduces false positives. A behavioural anomaly that is corroborated by endpoint and network indicators escalates to a high-confidence alert. A behavioural anomaly with no corroborating evidence is logged for context but does not trigger an analyst investigation.
This approach is core to how the cross-domain correlation engine achieves 0 false positives in independent testing. For a deeper explanation of the cross-domain correlation architecture, see Cross-Domain Correlation Explained.
Single Agent, Complete Visibility
Because SenseOn collects endpoint telemetry, network metadata, and authentication events from a single lightweight agent, there are no integration gaps. The agent sees what the user does on the endpoint (processes, files, registry), what the endpoint communicates on the network (connections, data volumes, protocols), and how the user authenticates (Kerberos, NTLM, SSO events). This unified data collection eliminates the integration overhead that plagues standalone UEBA deployments and ensures that behavioural models have complete, consistent data from day one.
No Separate Tool to Manage
Integrating UEBA within the detection platform means security teams do not need to deploy, configure, tune, and maintain a separate UEBA product. There is no additional licensing cost, no separate management console, and no integration engineering. Behaviour analytics is simply one of the analytical dimensions that the cross-domain correlation engine applies to every piece of telemetry it processes.
For organisations evaluating their approach to insider threat detection, see our guides on Insider Threat Detection and 6 Best Insider Threat Detection Tools.
Frequently Asked Questions
What does UEBA stand for?
UEBA stands for User and Entity Behaviour Analytics. It is a category of security technology that uses machine learning and statistical analysis to establish baselines of normal behaviour for users (employees, contractors, third parties) and entities (servers, applications, devices, service accounts), then detects anomalies that may indicate threats such as compromised accounts, insider attacks, or data exfiltration.
How is UEBA different from SIEM?
SIEM uses rule-based correlation to detect known threat patterns in log data. UEBA uses machine learning to detect unknown threats by identifying deviations from established behavioural baselines. SIEM requires analysts to define detection rules in advance, while UEBA can surface threats that no one anticipated. The two technologies are complementary, SIEM catches known-bad patterns, UEBA catches unknown-abnormal patterns, and they are increasingly converging within unified detection platforms.
How long does UEBA take to establish baselines?
Most UEBA systems require a learning period of 14 to 30 days to establish reliable behavioural baselines. During this period, the system observes normal patterns of activity for each user and entity. Some implementations require 60 to 90 days for full baseline maturity, particularly for users with highly variable work patterns or seasonal business cycles.
Can UEBA detect insider threats?
Yes, insider threat detection is one of UEBA's primary use cases. Because insiders have legitimate access, traditional rule-based detection struggles to distinguish malicious insider activity from normal work. UEBA detects insider threats by identifying behavioural deviations, such as accessing files outside normal scope, logging in at unusual hours, downloading abnormally large data volumes, or accessing unfamiliar systems, that may indicate malicious intent or a compromised account.
Does SenseOn include UEBA capabilities?
Yes. SenseOn's cross-domain correlation includes unsupervised learning algorithms that perform the same behavioural baselining and anomaly detection functions as standalone UEBA tools. The key difference is that SenseOn's UEBA capability is built into the detection engine rather than deployed as a separate product. Behavioural anomalies detected by unsupervised learning are cross-validated with supervised learning and deep learning to reduce false positives and increase detection confidence.
