User and Entity Behavior Analysis

UEBA solutions provide Security Operations Centers (SOCs) with visibility to detect user-related threats that might otherwise go unnoticed and the ability to protect against various attacks of different levels of complexity. Effective UEBA security tools can:

• Process machine data into a security-compliant schema
• Gain a real understanding of users, not just disparate accounts
• Identify and prioritize complex user-related threats
• Accelerate threat qualification and investigations
• Optimize responses through security operations workflows

When evaluating UEBA security tools, it’s essential to consider the core use cases based on your organization’s specific needs and requirements. At a high level, UEBA security can assist you in detecting and responding to the following UEBA use cases: compromised accounts, insider threats, and abuse or unauthorized use of privileged accounts.

Your organization collects and generates an enormous amount of data from various sources. Before analyzing this data, it needs to be normalized and enriched to enable efficient searching and machine analysis. Without successful data preparation for analysis, your UEBA solution is bound to have “blind spots,” resulting in false positives, missing critical actions, or, even worse, mischaracterizing harmless anomalies as threats.

Data processing begins with parsing machine data into metadata fields specially structured for security analytics. Applying a unified schema to the processed data is a key aspect of UEBA. Upon careful examination, significant differences in the capabilities of these features can be observed in various solutions. For instance, when receiving a notification about a change in permissions by an administrator affecting another user, the schema should be able to differentiate between the administrator and the user it impacted. Data normalization enhances the accuracy of analyzed data by adjusting values based on known deviations.

Data enrichment involves the process of adding metadata obtained from a log with additional contextual data for more efficient analysis. Below are some examples of data enrichment.

• Using geolocation to convert an IP address into an estimated location
• Decoding log codes into a meaningful and diagnostic vendor classification (for example, Windows Event ID 4624 = successful account login).