Exabeam Analyst key terms

Exabeam's behavioral modeling layer that builds baselines from normalized log and event data and scores sessions for risk. It replaces fixed correlation rules with statistical and machine-learning models that flag deviations from normal activity.

A per-user, per-device timeline that stitches together all events involving an identity across log sources into one continuous session. Analysts review a single session instead of correlating dozens of disconnected raw log entries.

A numeric value assigned to a session, user, or entity that aggregates the severity of anomalous behaviors observed. Higher scores push events toward analyst review, and thresholds determine when a case or alert is created.

A statistical profile of what is normal for a user, peer group, or entity over a learning period. Deviations from the baseline, such as new geographies or unusual hours, become the anomalies analytics surfaces.

Comparing an entity's activity against similar users, such as the same department or role, rather than against the entire population. It reduces false positives when a whole team legitimately changes behavior.

An observed event or sequence that statistically deviates from established normal behavior for an entity or peer group. Anomalies raise risk scores but are not automatically malicious; analysts add context to judge intent.

The practice of modeling individual user activity, such as logon patterns, data access, and application use, to detect compromised or misbehaving accounts. It focuses on identity rather than network or endpoint signatures.

Extending behavioral modeling beyond human users to devices, servers, service accounts, and other non-human entities. It detects anomalies such as a server suddenly authenticating to many hosts or a dormant service account waking up.

Any tracked actor in the analytics platform, including users, hosts, IP addresses, applications, and service accounts. Entities accumulate risk and history, letting analysts pivot from one compromised identity to related infrastructure.

The chronological visualization of a session showing each event, its source, and its contribution to risk. Analysts use it to reconstruct an attack sequence without manually joining logs from multiple systems.

A logic statement that fires when specified event conditions occur within a time window, such as multiple failed logons followed by a success. Rules complement behavioral models by catching known patterns deterministically.

Any configured logic, whether rule-based, behavioral, or threshold-driven, that generates a notable event or alert. Rule tuning and coverage review determine how well the platform detects real threats without alert fatigue.

The first-pass review of an alert to decide whether it is benign, a true positive, or needs escalation. Triage uses risk context, entity history, and enrichment to prioritize limited analyst time.

The workflow for grouping related alerts and evidence into an investigation record with status, owner, and notes. It preserves the audit trail of what was examined and what response actions were taken.

A documented, repeatable sequence of investigation and response steps for a given threat scenario. Playbooks standardize analyst decisions and can be partially automated for containment actions.

The structured process of preparing for, detecting, containing, eradicating, and recovering from a security incident. In this platform it is driven by session evidence, case records, and coordinated containment actions.

Proactively searching telemetry for adversary activity that existing detections missed, guided by hypotheses rather than alerts. Hunters pivot across sessions and entities to find weak signals and convert findings into new detections.

A public knowledge base of adversary tactics and techniques used to map detections and describe observed behavior. Mapping alerts to techniques helps analysts spot coverage gaps and communicate findings consistently.

An attacker's progression from one compromised host or account to others inside the network. It often appears as unusual remote service authentication, administrative share access, or new host-to-host connections.

Gaining higher permissions than an account was granted, such as adding a user to an admin group or exploiting a vulnerable service. It is a high-severity behavioral signal when seen from an ordinary user identity.

A legitimate user credential or session now controlled by an adversary. Indicators include impossible travel, new device fingerprints, unusual access volume, and authentication from unexpected networks.

Two authentications for the same identity from geographically distant locations within a timeframe that makes physical travel infeasible. It strongly suggests credential theft or session hijacking and typically raises risk sharply.

Automated attempts to log in using username and password pairs leaked from other breaches. It shows up as many failed authentications across accounts from a small set of source addresses, followed by occasional successes.

Repeated guessing of passwords or keys against an account or service until access succeeds. High failure counts in a short window, especially from one source, are the classic detection signal.

Risk originating from someone with legitimate access who misuses it, whether maliciously or through negligence. Detection relies on behavioral drift, access to unusual data, and activity outside normal role expectations.

Unauthorized transfer of data out of the environment, such as large uploads, mass file downloads, or transfers to personal cloud storage. Volume and destination novelty relative to baseline are key indicators.

Controls and monitoring that detect or block sensitive data leaving approved boundaries. DLP alerts enrich behavioral analytics with content-level context about what data was touched and where it went.

Misuse of non-interactive accounts intended for applications, often indicated by interactive logons, unusual hours, or access to unrelated systems. Such accounts are attractive because they rarely expire and hold broad permissions.

A system or feed that supplies event data to the platform, such as an identity provider, endpoint agent, firewall, or cloud audit log. Coverage and health of log sources determine what analytics can see.

The component that extracts fields from raw log messages into a structured schema. A broken parser silently degrades detection, so parser health monitoring is a routine operational task.

Mapping vendor-specific log fields into a common schema so events from different products can be compared and correlated. It is what lets an identity provider logon and a firewall session be joined into one timeline.

Adding context to events, such as asset criticality, user department, threat intelligence reputation, or geolocation. Enrichment converts raw events into information an analyst can judge quickly.

A rating of how important a host or system is to the business. It weights risk so that anomalous activity on a domain controller outranks the same activity on a lab machine.

Curated information about known malicious indicators, actors, and techniques, often consumed as feeds. Matching events against it adds reputation context, though stale or low-quality feeds create false positives.

A technical artifact such as a malicious IP address, domain, file hash, or user agent associated with known attacks. IOCs are useful for fast matching but age quickly as adversaries rotate infrastructure.

An alert raised for activity that is actually benign. Excess false positives cause alert fatigue and hide real threats, so tuning baselines, peer groups, and rule thresholds is continuous.

A named group of users or entities that receive heightened monitoring, such as executives, recent terminations, or high-risk contractors. Membership can adjust scoring and route alerts to specific analysts.

Security orchestration, automation, and response tooling that executes playbook steps across connected systems. It handles repetitive tasks like enrichment and containment requests so analysts focus on judgment.

The overall discipline of learning normal patterns of activity and flagging meaningful deviations. It spans users, entities, and peer groups and is the core differentiator of this platform's detection approach.