User and Entity Behavior Analytics (UEBA) and Agent Behavior Analytics (ABA) Configuration
What this domain tests
How behavioral baselines are built, which models produce anomalies, how risk is scored and consumed, and how the same machinery extends to machine identities and AI agents.
Core rules
- Entities are users, hosts, IPs, service accounts - and, under agent behavior analytics, non-human actors such as automation accounts and AI agents. An entity with no usable identity context cannot be baselined.
- Sessions are the unit of analysis: events are grouped into per-entity sessions (typically login to logout, with a timeout), and anomalies are scored inside that session.
- Models include peer-group comparison, time-of-day and volume/frequency deviations, first-seen conditions (new country, new host, new resource), and unusual event sequences.
- Risk scores accumulate from individual anomalies into a session score; thresholds and watchlists decide what becomes an alert or case.
- Learning window: baselines need representative data. Early in onboarding, scores are noisy - treat first-week anomalies as calibration, not truth.
Tuning, and doing it safely
Suppress known-good patterns (scripted service accounts, scanners, backup windows) with narrow exclusions rather than disabling models. Put executives and critical assets on watchlists to raise sensitivity, and keep peer groups meaningful - a developer compared against finance analysts generates permanent noise.
Agent Behavior Analytics
Extend baselining to AI agents and automation: which tools or APIs the agent calls, which data it touches, how many actions per session, and when. Typical signals are a new tool invocation, a spike in call volume, access outside the approved resource set, or an agent acting outside its owner's normal hours. Give every agent a named owner and least-privilege credentials, because the baseline is only as good as the identity behind it.
Worked example
A service account triggers nightly "unusual time" and "new host" anomalies. Reasoning: the behavior is scripted but the account was never modeled as machine-to-machine. Fix: confirm the pattern over a full cycle, add a scoped exclusion for the host set and time window, and instead watch for deviation from that pattern - a new host outside the set still scores.
Traps
- Enabling analytics before identity enrichment, then blaming the models.
- Over-whitelisting so genuine drift is invisible.
- Judging model quality during the learning window.
- Leaving AI agents and service accounts unowned and unmonitored.