Behavior Analytics
Behavior Analytics (UEBA) baselines how identities and hosts normally behave, detects anomalous lateral movement and unauthorized data access, and turns repeated or chained anomalies into risk.
Behavior Analytics (UEBA) baselines how identities and hosts normally behave, detects anomalous lateral movement and unauthorized data access, and turns repeated or chained anomalies into risk.
| Tab | Purpose |
|---|---|
| Overview | Risk distribution, top identities, open anomalies by detector, learning banner |
| Identities | Ranked identities; open an identity for anomaly timeline and risk chain |
| Anomalies | Faceted feed with operator feedback actions |
| Coverage | Per-OS prerequisite telemetry and honest inactive detector state |
| Detectors | Catalogue of detector logic and inputs |
| Suppressions | Documented exclusions with reason and scope |
What it baselines
Section titled “What it baselines”UEBA uses first-party endpoint facts, not a black-box import:
- session/logon facts;
- connection summaries;
- read-access summaries;
- principal type and privileged/service-account classification;
- host and peer context.
Server analytics maintain baselines in ClickHouse and periodically evaluate risk. Analysis settings include learning days, minimum baseline hours, alert threshold, re-alert delta, risk half-life, chain window and detector-specific thresholds.
Risk and learning
Section titled “Risk and learning”| Phase | Meaning |
|---|---|
| Learning | Too little history to alert reliably; page says so |
| Baseline | Normal behavior established |
| Anomaly | Detector condition outside normal bounds |
| Risk | Weighted/decayed anomaly state, including chains |
| Suppressed | Operator documented exception |
Learning suppression is deliberate. A new identity or newly enabled telemetry source should not produce a burst of pretend anomalies on its first hours of data.
Identity investigation
Section titled “Identity investigation”- Open Identities.
- Select a high-risk principal.
- Review anomaly timeline.
- Open the chain that produced the score.
- Check peer/host context and whether the account is service, privileged or human.
- Pivot to Events where the underlying facts are available.
- Contain from the device/response path if warranted; UEBA itself never calls Active Response.
Coverage honesty
Section titled “Coverage honesty”Coverage shows, per OS, how many devices shipped each prerequisite in the last 24 hours versus total devices. A detector whose telemetry reaches no device is inactive. This prevents a dashboard from claiming behavioral coverage when the required facts are absent.
Enabling telemetry
Section titled “Enabling telemetry”Agent Configuration → Log Collection includes a Behavior analytics telemetry group. Its switches and watch paths default off. Enable them for a pilot group, verify Coverage, then expand. Without prerequisite facts, the module cannot provide meaningful coverage.
Feedback and suppression
Section titled “Feedback and suppression”Use anomaly feedback to say whether a signal was useful. Use Suppressions for a documented, scoped exception, not to hide a class of behavior without explanation. Suppression should identify owner, reason and review expectations.