User and entity behaviour analytics (UEBA) is software that learns what is normal for each user and each machine in a company, and raises an alert when one of them behaves unusually. An entity here means anything other than a person that acts on the network, such as a server, a laptop or a printer. UEBA is usually a part of a SIEM.
Ordinary SIEM rules catch patterns that someone has already written down. But many attacks look like normal work. Someone who has stolen a password logs in with the correct password. Nothing about the login looks wrong on its own. What looks wrong is the behaviour that follows.
Consider an employee in the billing team at a hospital chain in Kochi. For three months, UEBA reads the logs of this employee's account. The employee logs in between 9 a.m. and 6 p.m., from the Kochi office laptop, and opens about 25 bills a day in the billing system. This becomes the employee's baseline, the record of normal behaviour. Then, on a Sunday at 11 p.m., the same account logs in from a laptop it has never used, in another city. It opens 3,000 patient records, which this account has never opened before. Each of these facts is unusual. UEBA adds them up into a risk score, a number for how unusual the account's behaviour is. The score crosses the limit, and UEBA raises an alert.
UEBA reads logs from many systems. It reads logins from single sign-on (SSO), and file copies reported by data loss prevention (DLP) tools. The same method is used to catch employees who misuse their own access. This is called insider risk management.
UEBA also makes mistakes. An employee who travels, or who works late before a deadline, also looks unusual. So a UEBA alert still needs triage by a person or by an AI SOC analyst before anyone acts on it. When the alert is confirmed, SOAR can disable the account automatically.