SECAI Core · phase 13 of 15 · noun
User and entity behavior analytics
A system that can provide automated identification of suspicious activity by user accounts and computer hosts.
The Explain card
- Plain English
- UEBA automatically profiles how user accounts and machines normally behave, then flags activity that breaks the pattern, without needing a predefined signature.
- Example
- A service account that normally calls the internal LLM API a few times an hour suddenly begins downloading fine-tuning datasets at three in the morning. UEBA scores the deviation and alerts the SOC.
- Why it matters
- Insider threats and stolen credentials look like legitimate users. Behaviour, not identity, gives them away, and AI systems with privileged data access are exactly what those users target.
- Hook
- It is not who you are, it is what you usually do.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The security operations center used user and entity behavior analytics to compare badge-reader events, VPN logins, and database queries during an account investigation.
Why these words
- user English use plus agent suffix -er names the human or account side of the phrase
- and Old English and joins the two kinds of subjects being analyzed
- entity Medieval Latin entitas, being or existence adds nonhuman objects such as devices, applications, and servers
- behavior English behave plus noun-forming suffix -ior focuses attention on actions, habits, and changes over time
- analytics Greek analytikos, analytical, through Late Latin analytica marks systematic examination of collected data
Where it came from
- Origin
- an English cybersecurity coinage expanded from user behavior analytics and popularized as a Gartner market-category term
- Entered the language
- 2015
- What changed
- User behavior analytics initially emphasized account activity; entity was added to include machines and other digital objects, producing the initialism UEBA.
How it is spelled
- Pattern
- behavior follows the American -or spelling pattern
- Pattern
- entity ends with the noun-forming suffix -ity
- Pattern
- analytics keeps the Greek-derived subject suffix -ics
- Breaks the pattern
- British English normally spells behavior as behaviour
Spelled like
- color
- favor
- identity
- activity
- statistics
- mathematics
Broken into chunks
-
use + -er
- user
- computer
-
entit- + -y
- entity
- entities
-
behav-
- behave
- behavioral
-
analyt-
- analysis
- analytic
What it sits beside
Same subject
- security information and event management
- insider threat detection
- anomaly detection
- endpoint detection and response
Same shape
- user behavior analytics
- identity and access management
- security information and event management
security monitoring technologies
- security information and event management
- endpoint detection and response
- network detection and response
behavior analysis terms
- user behavior analytics
- network behavior analysis
Where it sits in the deck
Phase 13: Detection, Monitoring, and Threat Intelligence
Defences eventually fail — learn how to detect, correlate, and investigate anomalies in real time across both AI-specific and traditional security telemetry.
