In this page
User and Entity Behavior Analytics (UEBA) in ManageEngine Log360 Cloud is an advanced security analytics capability designed to detect anomalous activities and potential threats by analyzing patterns in user and entity behavior. Unlike traditional rule-based detection systems, Log360 Cloud’s UEBA leverages machine learning (ML) and statistical modeling to establish behavioral baselines for users and hosts. This enables the identification of subtle deviations that may indicate malicious activity, such as insider threats, data exfiltration, account compromises, and Advanced Persistent Threats (APTs).
Log360 Cloud's UEBA also comes with integrated risk scoring mechanism, which assigns a risk score to users and entities. This helps prioritize potential bad actors based on severity, enabling you to minimize the incident response time, if any.
Log360 Cloud's UEBA enhances security analytics by leveraging machine learning to establish behavioral baselines, enabling the detection of subtle, slow-moving threats like Advanced Persistent Threats (APTs) that evade traditional rule-based systems.
Unlike static correlation rules, which rely on predefined patterns (e.g., "five failed logins in 5 minutes"), UEBA’s anomaly detection identifies deviations from normal behavior, for example, a device communicating with rare external IPs, or a secure folder or a set of files is usually accessed only by very specific user(s) or a host, is now suddenly being accessed by a new user or host. This will be flagged as an anomaly initially. But if such behavior becomes repetitive, the model gets trained with the same gradually, and it won't flag it as an anomaly anymore. While correlation rules excel at flagging known attack sequences (e.g., brute-force attempts followed by a successful login), UEBA focuses on detecting contextual anomalies—low-risk, sporadic activities that collectively indicate a stealthy attack.
By assigning risk scores to these anomalous users and entities, Log360 Cloud's UEBA prioritizes users and entities that could pose as potential threats that correlation rules might miss, bridging the gap between immediate alerts and long-term attack patterns. Together, anomaly detection and correlation rules provide layered defense: the former helps uncover novel or slow-burning risks, while the latter targets specific, predefined threats, ensuring comprehensive coverage against both known and emerging attack vectors.
Risk Accumulation Methodology
Anomalous behavior of users and entities is constantly monitored keenly by Log360 Cloud's UEBA across the network. Over time, if a user or entity is repeatedly detected for anomalies, their cumulative behavior contributes to an elevated risk score, even if the anomalies in question seem to be negligible at first. This approach proves to be beneficial in the detection of Advanced Persistent Threats (APTs), which often rely on maintaining a low profile and performing subtle actions that evade traditional security alerts.
Temporal Pattern Recognition
The solution monitors for temporal patterns in user and entity behaviors, identifying suspicious progressions of activities that might individually appear innocuous but collectively reveal attack methodologies. This capability is crucial for detecting threat actors who operate over extended timeframes to achieve their objectives.
Lateral Movement Detection
By tracking entity relationships and access patterns, Log360 Cloud's UEBA can identify lateral movement within networks—a common tactic in APT campaigns where attackers progressively expand their control across systems while maintaining stealth. The system correlates seemingly unrelated events across different network segments to expose these sophisticated attack chains.
Data Exfiltration Indicators
The UEBA component specifically monitors for subtle indicators of data exfiltration attempts, such as suspicious bulk file modifications or deletions on Windows systems and bulk data transfer activities in cloud platforms like Salesforce. These indicators are crucial for identifying the final stages of many APT attacks.
Read also
This document elaborated the overview and use cases of Log360 Cloud's UEBA. For configuring and leveraging the capabilities of UEBA, refer the below articles: