Skip to main content
Version: 6.1

UBA Module

Purpose​

The User Behavior Analytics (UBA) module builds behavior profiles for users, hosts, service accounts, and other entities. It compares current events with the accumulated profile and converts detected deviations into risk scores.

Any index can be a data source

You can use any index or index pattern with the required fields to fill the objects list and build profiles. You can also use an index aggregator, such as the Inventory module or an index created in another way. Use it as a convenient intermediate aggregator to collect data from multiple sources, normalize fields, enrich records, and prepare one current record per object.

The index used to fill the objects list and the event indexes used for profiling can be different. For example, you can load objects from a prepared reference index and analyze behavior using authentication logs.

Full Processing Cycle​

Full UBA module processing cycle

  1. Prepare objects. Define base and additional fields in the object type. The object fill configuration reads the selected index, applies time and custom filters, maps source fields to object type fields, and creates the UBA objects list.
  2. Build profiles. The profiling policy selects events for each entity using identity fields, runs its algorithms, and writes baseline values to profile indexes.
  3. Detect anomalies. A scheduled job compares current events with the profile indexes. When it detects a deviation, an Active Action assigns a risk score to the entity.
  4. Calculate scoring. The scoring calculation aggregates active scores according to their lifetime. The entity profile displays the resulting score, score history, and profiling results.

End-to-End Entity Identifier​

Every stage must use the same normalized identifier:

  • Object identifier field in the object fill configuration identifies a unique entity in the input data
  • the object type base field stores this value in the UBA object
  • Fields for identifying an object in indexes in the policy maps events to the object base field
  • the identifier field in the anomaly detection job links the event to the profile index and the assigned score

Differences in case, format, or identifier composition prevent matching. For example, normalize ivanov, IVANOV, and domain\\ivanov to one format in advance, or deliberately configure case-insensitive matching.

  1. Configure an object type and a compatible scoring type
  2. Prepare unique input records and fill the objects list
  3. Create a profiling policy and verify its run results
  4. Create an anomaly detection job with a risk score Active Action
  5. Configure a scoring calculation
  6. Verify the result in the entity profile

The end-to-end configuration example provides a complete set of sample values for all stages.

Deviation Examples​

  • a VPN connection at an unusual time for the user
  • a VPN connection from a new country or city
  • the first launch of a previously unused application
  • an unusually large volume of sent email