UEBA

User and Entity Behaviour Analytics (UEBA) detects unusual behaviour from people, accounts, and devices. It compares current activities against a baseline of learned, normal behaviour.

How it works

UEBA analyses data over several weeks to learn when an account logs in and which systems it accesses. It also looks at how much data is transferred. From this, it creates a profile for each person, account, or device. If an activity deviates significantly, the system raises a risk score. An Alert is created once a certain threshold is reached.

For example

An employee in accounting normally accesses three applications. One Saturday, their account downloads 40 GB from a development file server. Individually, none of these actions are forbidden. UEBA detects the deviation, and the SOC investigates if the account has been compromised.

What to look out for

• Learning phase: It takes several weeks to establish a baseline of normal behaviour. During this period, the system may generate more noise.
• Data quality: Profiles are inaccurate without a clean mapping of accounts to individuals.
• Explainability: Analysts must be able to understand why a risk score has increased.
• Combination: UEBA provides clues rather than definitive proof. It requires data from other sources.

Switzerland and regulation

UEBA analyses employee behaviour. According to Art. 26 ArGV 3, surveillance systems are prohibited if their main purpose is monitoring employee behaviour. However, security monitoring is permitted if it serves another purpose and is proportionate. Employees must also be informed about the monitoring. The revFADP (revised Federal Act on Data Protection) also requires a clear purpose and transparency.

Typical mistakes

Many organisations expect UEBA to provide conclusive assessments. In practice, it offers clues that an analyst must verify with other data. A second mistake is outdated master data. If job changes or departures are not updated, the profiles become inaccurate. Therefore, integrate your HR or identity system as a source. This noticeably improves the quality of the findings.

How we implement it

We use behaviour analytics primarily for identities and accounts. The analysis is limited to security purposes and is agreed with you during onboarding.