User and Entity Behavior Analytics (UEBA)
User and entity behavior analytics (UEBA)
UEBA is the exam's behavioral core: how Exabeam learns normal activity for users, hosts, and other entities, scores deviations, and presents them as sessions and timelines an analyst can investigate. Questions focus on baselining, peer groups, risk scoring, anomaly interpretation, and tuning rather than on memorizing model names.
Core rules and concepts
- A baseline is contextual. Normal for a developer, a finance analyst, and a service account differs by role, peer group, time of day, location, and asset.
- Exabeam-style analytics groups activity into sessions. A session is a sequence of related events for an entity, not a single log line. The Smart Timeline shows the sequence and highlights anomalous events.
- Risk is cumulative and comparative. A risk score helps prioritize, but it is not a verdict. High risk can come from one rare event or many low-level deviations.
- Common behavioral signals include first-seen activity, unusual access volume, abnormal time or location, new peer relationships, privilege changes, and deviation from the entity's own history.
- Watchlists and rules add analyst intent. Use them to prioritize sensitive users, contractors, executives, or critical assets, but review them for staleness.
Worked example
A backup service account normally reads file shares between 01:00 and 03:00 from two servers. Today it authenticates from a workstation at 14:00, accesses HR shares it has never touched, and creates a new scheduled task. Reasoning: the entity baseline is strong and the deviation is multi-signal. Check whether a change ticket authorized a new backup host, whether the account password was rotated, and whether the workstation is a known admin jump host. If no ticket exists and the scheduled task launches an unknown binary, treat it as compromised credentials, disable the account, and investigate the host. If a migration project explains all three events, document the exception and tune the peer group or rule.
Traps
- Calling every first-seen event malicious; first-seen is a prompt to investigate.
- Ignoring seasonal or project-driven changes that distort baselines.
- Over-tuning after one false positive until real anomalies are suppressed.
- Treating a risk score as an incident severity without context.