thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

User and Entity Behavior Analytics (UEBA)

Analytics that baseline normal behavior of users and entities and flag anomalies that may indicate threats.

Definition

UEBA applies statistical and machine-learning models to identity, endpoint and application data to detect insider threats, compromised accounts and privilege abuse. Entities include hosts, applications and service accounts. It is built into many SIEM and XDR platforms.

Example

UEBA flags an engineer downloading 50 times their usual volume from SharePoint before resigning.

Exam tip

UEBA is the go-to answer for detecting insider threats and compromised credentials.

Related terms