UBA in the SOC - please what?

In connection with our Security Operation Centre, we are often asked about the SIEM technology used. When it comes to communicating benefits, the term "user behaviour analytics" is often used and it is often not entirely clear what is actually so ingenious about it.

In this article, we want to shed some light on the subject.

UBA, sometimes also called UEBA (User Entity Behaviour Analytics), is primarily a category of software that helps cyber security teams to identify and defend against insider threats.

These threats are difficult to identify and can cause a great deal of damage. In order for the system to be able to recognise what is dangerous and what is not, the system has to learn.

Possible threats from insiders:

Misuse of privileged accounts
Privilege escalation
Data exfiltration
Anomalous behaviour
Compromised credentials

How does UBA work and what data is actually analysed?

Data sources originating from users, devices, system accounts and privileged accounts are primarily correlated. The correlation reveals anomalies, even over longer periods of time. The system learns all behaviour patterns and can therefore also detect potential threats if these patterns change conspicuously.

A UBA solution creates baseline values for normal behaviour for all users, devices, applications, privileged accounts and shared service accounts and then detects standard deviations from the norm. The tool then assigns a risk score to the threat in question so that the organisation can not only review notifications on a daily basis, but also monitor the worst malicious users and take preventative action. This can all be seen in real time in the dashboard:

The tool then provides a list of threats to be remediated as well as associated evidence explaining why a particular threat should be heeded. This list is primarily to be reviewed by security analysts. Depending on the approach of the UBA solution, automated responses can also be implemented as a set of rules. In this way, the system is constantly learning.

The system learns?

Machine learning plays a crucial role here. Analysis tools based on machine learning algorithms do not require signatures or human analysis and enable the creation of profiles on the behaviour of multiple entities as well as peer group analyses. This opens up more sophisticated monitoring and response capabilities for UBA.

With machine learning, analysts and security operations centre (SOC) teams can conduct rapid investigations, gain meaningful insights, determine the root cause of an incident, rely on historical trends and share findings without being bogged down by thousands of notifications and false positives. Simply put, companies can accelerate detection, analyse the impact and respond quickly to security incidents.