Cybersecurity
UEBA compares an account or a host with its own recent history and flags a change, such as a new country or a volume of file access that person has not shown before. A flag is a lead, not a verdict. Novatelia includes this method inside the SIEM scope when the log sources can support it. It is not a staffed watch and it does not publish an accuracy figure.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- The baseline is that identity’s own history, not a universal score.
- A flag still needs a person.
- Poor logs produce poor baselines.
Definition
User and entity behavior analytics is a way of scoring change. It depends on identity logs and the other sources that describe what the account did. It does not prove intent.
How it works
The platform builds a baseline from the agreed history, scores new events against it, and raises a lead when the change crosses a threshold the project sets. An investigator confirms or closes the lead.
Architecture
- Identity and the other logs required for the behavior in question.
- A baseline window that is long enough to mean something.
- A review step so a score does not become an automatic punishment.
Use cases
- A project wants a lead when an account’s sign-in pattern changes.
- File-access volume is a concern and the file system actually logs it.
- A SIEM design needs analytics beyond a single static rule.
Selection guidance
- Confirm the logs exist before buying the analytics license.
- Decide who reviews leads and in what hours, in writing.
- Do not describe a score as proof of fraud or of an intrusion.
Questions
Is UEBA a product by itself?
Sometimes it is a module of a SIEM or an identity product. The published scope is the analytics design on the SIEM solution, not a promise that a brand name includes the module.
Can it run without a person?
It can raise a lead without a person. Acting on the lead is a separate decision. This site does not publish an automated response or an accuracy rate.
Related
More in Cybersecurity
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.