UEBA
UEBA (User and Entity Behaviour Analytics) is security tooling that uses behavioural analytics and machine learning to identify abnormal, potentially dangerous behaviour of users and devices.
What is UEBA?
Definition
UEBA (User and Entity Behaviour Analytics) is security tooling that builds a baseline of how each user and device normally behaves, then flags departures from it — a login from an unusual place, access to data this account has never touched, volumes that do not fit the role. The point is that it needs no signature: a technique may be entirely new and still look wrong against the baseline. In cybersecurity practice its usefulness rises and falls with tuning, because an organisation where “normal” was never stable produces a great many alerts that mean nothing.
Role in cybersecurity
UEBA plays an important role in building organizational resilience against cyber threats. Implementing appropriate mechanisms in this area is required by regulations such as NIS2, DORA and ISO 27001.