Top 9 User and Entity Behavior Analytics (UEBA) Tools
As a CISO in a highly regulated industry with ~2 decades of cybersecurity expertise, I compared the top 9 user and entity behavior analytics (UEBA) tools that can help SOCs detect abnormal and potentially dangerous user and device behavior:
Feature comparison
See feature descriptions.
User and entity behavior analytics (UEBA) tools help enterprises discover modern zero-day and insider threats on their networks that would remain undetected by traditional security tools..
To detect these threats, UEBA tools use ML to create baseline behaviors for individual users and resources in a network and then use statistical analysis to identify deviations from that baseline.
These anomalous activities may indicate that an entity or a user’s account has been compromised. When the UEBA solution detects such a variation, it assigns a risk score and provides incident information and remediation suggestions.
These tools are often used alongside other enterprise security solutions such as security information and event management (SIEM), data-centric security, data loss prevention (DLP), and employee monitoring software.
To better communicate functionalities and benefits, I categorized the top 9 UEBA-integrated tools into the following key topics:
- SIEM tools with UEBA
- DLP tools with UEBA
- Data-centric security software with UEBA
- Insider risk management solutions with UEBA
Disclaimer: Insights (below) come from our experience with these solutions as well as other users’ experiences shared in Reddit 1 , Gartner 2 , and G23 .
1. SIEM tools with UEBA
Depending exclusively on SIEM tools is ineffective in detecting all cases of breaches. Some compromises can be complex, and gain access to a system. For example, attackers may use valid credentials collected via phishing or brute force attacks to leak your data.
UEBA is especially useful in this situation since it analyzes the usual authentication patterns used by network users and entities and then compares current events with historical or peer patterns. This helps identify logins from unusual locations or devices.
Benefits: Organizations integrating SIEM with UEBA can have:
- More data sources
- More accurate analysis
- More actionable alerts
- More efficient incident response
ManageEngine Log360
ManageEngine Log360 is a UEBA-integrated SIEM solution with SOAR capabilities. Log360 UEBA may be an add-on with ADAudit Plus, EventLog Analyzer, and Cloud Security Plus in Log360.
Key features:
Anomalous user and entity activity analytics: Log 360 identifies unusual user and entity activity, such as logins at unusual times, numerous login failures, and file removals from a host not often used by a certain user.
Anomaly reporting: It offers comprehensive anomaly reporting across devices and applications to detect and mitigate potential security risks:
- Devices:
- Windows devices: Monitors startup and shutdown events, service and software installations, USB activity, application whitelisting, logins, file changes, and firewall modifications.
- Unix devices: Tracks USB activity, logons, VMware logins, and file transfers.
- Routers: Detects configuration changes and login activities.
- Applications:
- Active Directory auditing: Monitors logins, process activity, and user management actions.
- Microsoft SQL servers: Tracks data modifications, logins, startup/shutdown events, password changes, and account management.
- FTP servers: File transfers, logons, and file activity.
Score-based risk assessment: The solution visualizes an overall risk score for every user and host based on the extent of the anomalies. With Log 360 UEBA you can execute risk scoring for five risk categories:
- Insider threats
- Data exfiltration
- Compromised accounts
- Logon anomalies
- Overall anomalies on cloud infrastructures, databases, file servers, etc.
Key considerations:
Note that ManageEngine Log 360 gets default threat data from open-source STIX/TAXII servers, which may result in false positive notifications.
You should consider whitelisting them or using threat analytics, an add-on feature of Log 360 that collects data directly from Webroot, making score-risk assessment more reliable.
Additionally, dependent on feed quality, free feeds can generate noise and false positives, requiring fine-tuning. However, paid feeds provide more accurate risk detection.
Thus, when fine-tuned ManageEngine Log 360 can effectively identify high-severity threats, such as limiting unnecessary ports or creating accurate threat filtering.
IBM Security QRadar SIEM
IBM Security QRadar is an SIEM platform with user behavior analytics (UBA) capabilities. QRadar SIEM tracks each threat approach and correlates related behaviors.
Key features:
QRadar analytics: IBM Security QRadar SIEM analyzes threat intelligence, network, and user behavior abnormalities to identify vulnerable network components.
User behavior analytics (UBA): The solutions support offers two primary UBA functions: risk profiling and unified user IDs.
- Risk profiling involves attributing risk to various security use cases based on criteria such as malicious website usage. Each one is assigned a risk based on the severity and reliability of the identified occurrence.
- Unified user IDs entail creating insights and profiles of user threats by leveraging existing event and flow data in your QRadar system.
QRadar’s UBA employs three forms of traffic, which are listed below:
- Network traffic: Traffic related to access, authentication, and account changes.
- User behavior on the network: Proxy servers, firewalls, intrusion prevention systems (IPS), and VPNs
- Endpoint and application logs: Windows or Linux, SaaS app logs.
Key considerations:
QRadar is suitable for straightforward, app/system logging. Also known as ‘structured data’. QRadar is commonly used by SOC/Infosec teams.
Note that, QRadar accurately assigns risk scores based on user activity but requires prior experience with SIEM and UEBA systems. It demands hands-on expertise, and users may be required to fine-tune hundreds of alerts for optimal performance.
Exabeam
Exabeam is a SIEM + XDR platform that enables analysts to collect log data, use behavioral analytics to detect attacks, and automate incident response.
With Exabeam, users can integrate data streams from multiple SIEMs, including IBM QRadar, Splunk, LogRhythm, Microsoft Sentinel, OpenText ArcSight, McAfee Nitro, Sumo Logic, and Google Cloud Pub/Sub.
Key features:
Rule and signature-free incident detection: Exabeam identifies unknown or zero-day threats by analyzing patterns and anomalies in real-time.
Automatic timelines for security incidents: Exabeam combines associated security events to create a timeline that depicts a security issue across numerous users, IP addresses, and IT systems.
Dynamic peer groupings: Exabeam dynamically groups similar entities (such as users from the same department or IoT devices of the same class).
Key considerations:
Exabeam organizes events in attack timelines to visualize high-risk activities and automate responses for routine and urgent tasks. This enables security teams to streamline their workflows while identifying anomalies and detecting insider threats through behavior baselines.
However, Exabeam falls short as a full-fledged SIEM solution, with challenges in performing essential tasks like monitoring log source activity and managing high event-per-second (EPS) rates.
For example, Exabeam requires extensive customization, such as configuring flatline rules or tuning alerts, to achieve desired outcomes.
Thus, organizations seeking a SIEM-focused tool may face limitations, especially compared to alternatives like IBM Security QRadar SIEM.
Splunk User Behavior Analytics
Splunk offers UEBA as a standalone solution or an add-on for customers of its SIEM solutions.
Key features:
Threat review and exploration: Splunk (UBA) visualizes threats throughout a path to acquire perspective.
Threat severity and detection feedback: Splunk (UBA) provides granular feedback for customized anomaly models based on your organization’s processes, regulations, assets, and user roles.
Key considerations:
This toolbox is not a Splunk implementation. It is a re-implementation and re-packaging of various open-source products.
The software exports raw Splunk events via the Splunk search feature and re-ingests them into open-source projects.
Thus, while deploying Splunk User Behavior Analytics, make sure that your infrastructure can manage several searches/ingests to extract data from events.
2. DLP tools with UEBA
UEBA enriches DLP tools by providing a deeper context of user behavior, allowing for more accurate detection of potential data breaches.
DLP alone: A DLP system only flags an email containing a sensitive document attached, but without knowing the user’s typical behavior, it might not identify this as a potential breach if the user normally sends such documents.
UEBA + DLP: With UEBA, the system would also analyze if the user is sending this type of sensitive document outside their usual work hours, to an unusual recipient, or in an unusually large volume, which could indicate suspicious activity and trigger further investigation.
Benefits:
- Behavioral analysis
- Insider threat detection
- Enhanced contextual information like user location, device type, and network activity.
Real-life example: A global media and telecom provider was able to automate the mitigation of 80% of reported non-malicious end-user policy violations by integrating UEBA capabilities with their DLP implementation.4
Teramind
Teramind is data loss prevention tool that enables organizations to monitor user behavior analytics (e.g. employees’ actions, remote users, and external contractors) to prevent data leaks.
Teramind monitors apps, websites, emails, instant messages, social media, file transfers, printers, and networks. With Teramin,d administrators can set rules to notify, block, log out, redirect, or block users.
Teramind supports compliance with privacy and security regulations like GDPR, HIPAA, PCI DSS, and ISO 27001.
Key features:
Behavior monitoring: Teramind identifies excessive personal internet usage, unauthorized access attempts, or policy violations.
Active vs. Idle time analysis: Teramind monitors and reports on active and idle time, providing detailed insights into user productivity.
Mobile app: Teramind offers mobile visibility with its Android dashboard. It is available for Cloud, On-Premise, and Private Cloud (AWS, Azure) deployments.
Key considerations:
Teramind logs mouse movements, app usage, and even screen activity. This makes it less effective to discover non-work-related behavior.
However, Teramind creates detailed activity timelines and customized playbook responses, which makes it easier to detect inconsistencies:
- Time-stamped screen recordings: Get immediate context by replaying the moments leading up to and immediately after a security incident.
- Compliance playbooks: Create your own compliance playbooks using automated blocking and alerts.
Forcepoint Insider Threat
Forcepoint Insider Threat is a security system that has over 15 years of expertise in detecting and mitigating internal threats for government and Fortune 100 companies.
The solution can monitor user behavior (e.g. logins, print jobs) and entity information (e.g. HR data).
Key features:
Scoring systems: Forcepoint Behavioral Analytics uses several scoring systems and analytics to provide insights about individuals based on their actions.
Automated notifications: The solution provides granular, configurable settings that allow security managers to establish automated notifications for specific employee actions of concern
Key considerations:
Forcepoint Insider Threat is effective in enabling proactive security measures by connecting user behavior to data movement. We recommend Forcepoint Insider Threat for:
- Large companies that demand broad monitoring capabilities and have the budget to integrate the product with other Forcepoint tools for a stronger security posture.
- Companies with a history of insider threats.
While Forcepoint Insider Threat offers robust capabilities to address complex security needs, its implementation can be challenging, often requiring substantial resources and specialized expertise to seamlessly integrate with existing IT infrastructures.
Additionally, Forcepoint Insider Threat provides more seamless integration capabilities with Forcepoint products rather than third-party tools, making its integration options more effective for organizations already committed to the Forcepoint ecosystem.
3. Data-centric security software with UEBA
UEBA can enrich data-security software by enabling deeper context, dynamic threat evaluation, and adaptive security responses.
Data enrichment:
- Contextual insights: By evaluating the degree of suspicious activity, UEBA can enhance data by incorporating information about individual behaviors.
- Enhanced threat evaluation: By enriching logs and activities with user profiles and metadata, UEBA can assess the degree of suspicious activity more effectively.
For instance, logging into a sensitive database during non-working hours from an unfamiliar device triggers a higher risk score.
Adaptive rule evolution:
- Continuous learning: UEBA models evolve dynamically by gathering data from more occurrences over time, improving their threat ability to provide more accurate threat detection.
- Customizable thresholds: As new patterns emerge, UEBA adjusts its rules and baselines, reducing false positives.
Benefits:
- Enriched activity logs
- Dynamic threat assessments
- Proactive risk management
Cynet
Cynet offers incident response, intrusion detection, user and entity behavior analytics (UEBA), and extended detection and response (XDR) capabilities.
It works by monitoring endpoints/networks and analyzing suspicious activity. It provides automated remedial protection, as well as an option for analysts to perform manual remediation.
Deployment methods: On-premise, IAAS, SAAS, and hybrid model.
Key features:
Customizable baseline user behavior: Cynets define behavioral patterns using associated information such as role, group, geography, working hours
Automated alerts and remediation: Cynet sends out alerts when suspicious activity is detected. You can also automatically block compromised accounts or evaluate the activity context.
Key considerations:
Cynet is an EDR solution with UEBA capabilities that offer 24/7 SOC support (CyOps), endpoint protection, and threat detection (note that Managed Detection and Response (MDR) features require additional fees).
However, its automated remediation processes often fail, and the software generates significant noise with false positives, exceeding 90%.
We recommend Cynet to smaller businesses or those with limited budgets for dedicated SOC services.
Varonis Data Security Platform
Varonis provides data security posture management (DSPM), including sensitive data discovery, data access governance, abnormal behavior detection, GDPR compliance assistance, incident playbooks, and cybersecurity forensic reporting.
Connector integrations: Users can integrate Varonis through their existing SIEM/SOAR platform via connectors such as Splunk, QRadar, Palo Alto Cortex XSOAR, Google Chronicle SOAR, etc.
Key features:
Threat hunting: Varonis enables organizations to monitor their data, user activity, and networks to detect threats and identify potential risks proactively.
Managed data detection and response (MDDR): Varonis’, MDDR focuses on data threats rather than endpoints. Varonis enables users to detect and respond to data-related security threats in real-time.
Key considerations:
Varonis is primarily used for data security and governance, providing essential capabilities like data classification, and alerting for anomalous events (e.g., ransomware).
Varonis integrates with your SIEM/SOAR through several connectors (Splunk, QRadar, Palo Alto Cortex XSOAR) or via syslog/SNMP. This makes it a strong choice for data-centric enterprises with intense security operations looking to investigate who accessed or modified files.
4. Insider risk management solutions with UEBA
Insider risk management solutions are specifically designed to manage risks from trusted insiders.
With UEBA these solutions can gain context-rich insights and risk scores regarding behavioral changes indicating malicious intent, such as elevated access requests or file deletions.
Benefits:
- More accurate insights for privileged access breaches
- More accurate lateral movement detection
- Context-rich insider threat investigations
Microsoft Defender for Identity
Microsoft Defender for Identity (formerly Azure Advanced Threat Protection, or Azure ATP) is primarily focused on AD threats.
What data does Defender for Identity collect?
- Network traffic to and from domain controllers, including DNS queries.
- Security logs, including Windows security events.
- Active Directory information, including subnets.
- Entity information includes names, email addresses, and phone numbers.
Key features:
Alert scoring: Defender for Identity shows each user’s impact on a specific alert. Alerts are scored based on their severity, user impact, and popularity.
Activity scoring: Defender for Identity estimates the likelihood of a certain user undertaking a specific activity based on the user’s and their peers’ behavioral learning.
Key considerations:
Defender for Identity is used for on-premises AD because the agent is installed on Domain Controllers monitors on-premises AD logs. If you are looking to protect your endpoint from malicious activity Defender for Endpoint integration will be needed.
Integrations:
- Microsoft tools: The solution integrates seamlessly with other Microsoft solutions, enabling users to correlate identity alerts with signals across the Microsoft ecosystem.
- SIEMs: The solution has seamless integration capabilities with SIEMs. It can be configured to send a Syslog alert, to any SIEM server when a security alert is detected. This helps gain context-rich insider threat investigations.
Key factors to consider while implementing UEBA tools
1. UEBA tools are not focused on blocking hackers
Instead, UEBA will alert you when it detects potential attacks such as:
2. UEBA tools are not standalone solutions
UEBA tools are complementary and cannot fully replace other security systems. It should be noted that UEBA tools and processes are not intended to replace existing network monitoring systems, but rather to enhance them and improve your company’s data security posture.
3. UEBA solutions can complement or integrate with other security systems
By stacking UEBA and other security tools together, enterprises are better able to detect and respond to threats.
For example, UEBA should be utilized when used with a software defined perimeter (SDP) solution. SDP solutions use data from perimeter technologies such as DNS, VPN, and web proxies to detect indicators of an attack at the perimeter.
These tools contextualize perimeter activity with a user’s core data access behavior, geography, and security group memberships. UEBA solutions integrated with SDP can provide your SOC analysts with more accurate alerts.
Feature descriptions
Vendors with:
- Peer group analysis can use machine learning to identify users and hosts with similar characteristics and categorize them as one group. This helps identify the context behind a user’s behavior and compare it with the behavior of a relevant peer group.
- Threat intelligence provide detailed, actionable threat information including:
- tactical intelligence (real-time)
- operational intelligence (proactive)
- strategic intelligence (far outlook)
Key differentiators in UEBA applications
FAQ
Further reading
Reference Links
Be the first to comment
Your email address will not be published. All fields are required.