domains / families / security / performing-user-behavior-analytics

performing-user-behavior-analytics

separate

'Performs User and Entity Behavior Analytics (UEBA) to detect anomalous

When to use

• SOC teams need to detect compromised accounts through abnormal authentication patterns
• Insider threat programs require behavioral monitoring beyond rule-based detection
• Impossible travel or geographic anomalies indicate credential compromise
• Privileged account monitoring requires baseline deviation detection

When not to use

• sole basis for disciplinary action

Skill page

Source