UEBA · Detection engineering · Data quality
A score of 87 is not a finding
UEBA models what normal looks like for an entity and scores deviation. That is a narrower claim than the marketing makes. This is a working reference for the data engineering, the models, and the operational discipline that decide whether a deployment detects anything.
Start from what you have
Most people arrive at behavioural analytics with a question shaped like what can I detect with the logs I already collect? The library is organised to answer that directly — every record names the telemetry it requires, and the catalogue can be browsed by data source rather than by topic.
If you have authentication logs and nothing else, that is enough to begin. It is the single most valuable source in this field, and roughly a third of what follows is reachable with it alone.
Four things worth knowing before you deploy
Data quality dominates model choice. A percentile baseline on well-normalised data with correct entity resolution outperforms a sophisticated model on fragmented logs. Most disappointing deployments are data engineering failures wearing an analytics label.
Review capacity is the ceiling. A queue larger than what a person can examine is not detection. Thresholds should be set from measured capacity, not from a number that felt right.
Rare is not anomalous. In an organisation of any size, thousands of people do something for the first time every day. Rarity alone is the largest single source of false positives in the field.
Unusual is not wrong. A score measures deviation. Any product presenting one as an indication of intent is overstating what the mathematics supports.
What this site is not
It is not a product comparison and it carries no vendor material. Where commercial products are discussed, it is in terms of what to ask them and what the answers indicate.
It is written entirely from the defensive side. There is nothing here about evading monitoring or moving data without detection, and there will not be.
All 42 records
Grouped by section. Each record appears once. Descriptions are on the section pages, and there is also an index by data source.
What UEBA is, what an entity is, what a baseline actually models, and how a score is assembled. Start here if the vocabulary is new or if the difference between UEBA and correlation rules is unclear.
Sources, entity resolution, normalisation, time handling and enrichment. Most analytics failures are data failures, and the failure mode is silence rather than error.
Statistical baselines, unsupervised models, features, sequences and relationship analytics. What each method can see, what it cannot, and how to tell which you need.
- Statistical Baselines vs Machine LearningAnalysis
- Rare Is Not AnomalousExplainer
- Feature Engineering for BehaviourProcedure
- Unsupervised Detection: LimitsAnalysis
- Labels: Using Analyst JudgementAnalysis
- Sequence and Session AnalyticsAnalysis
- Detecting Lateral MovementProcedure
- Cold Start: Entities With No HistoryProcedure
- Seasonality and the Business CalendarReference
- Modelling Privileged UsersProcedure
Tuning, alert volume, triage, feedback loops, drift and measurement. Review capacity is the binding constraint on every deployment, and most of this section is about respecting that.
- Tuning a UEBA DeploymentProcedure
- Alert Volume and Review CapacityProcedure
- How to Investigate a Risk ScoreProcedure
- Feedback Loops That Improve DetectionProcedure
- Measuring Quality Without Ground TruthAnalysis
- Base Rates: The Arithmetic Nobody ShowsAnalysis
- Model Drift and RetrainingProcedure
- Running a UEBA Proof of ConceptChecklist
- Fitting UEBA Into an Existing SOCProcedure
- Testing Detection With Red TeamsProcedure
Privacy obligations, bias in behavioural models, explainability requirements, minimisation and the controls on who may look at whom.
Why deployments fail, what to ask vendors, what small teams can do without a platform, and where the field is heading.