Support
 
Phone Get Quote
 
Support
 
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

Live Chat

Get Quote

ADAudit Plus » Get Quote
 
  

User Behavior Analytics (UBA) is a cyber security process that often uses machine learning technology to detect unusual user activities on the network.This technology is particularly useful in detecting insider threats, data exfiltration, account compromise, and Advanced Persistent Threats (APT) within the network.

UBA establishes a baseline for user activity and any deviation from this baseline will be highlighted. To determine the baseline, the process takes a certain time period known as the training period. This time frame for training varies depending on the backend algorithm that's used. Once the system gets trained, it will begin to analyze the network activities and spot the outliers. One of the advantages of such a process is that it doesn't require human interaction. Most ML algorithms are unsupervised and they dynamically train the system based on the changes in the environment. Since it is a dynamic process, the baseline for user activity is constantly updated.

Rule-based vs Behavior-based threat detection

UBA, which is a model-based system shines much better when compared with the more traditional rule-based system. A model-based system is much more efficient at analyzing events on the network to decide whether or not an event is a threat. A rule-based system works on a body of rules that have been pre-configured, while a model-based system works by establishing a dynamic baseline for user behavior and issuing an alert whenever the behavior veers off from the baseline. For rule-based systems to function efficiently, the administrators have to formulate rules for every potential threat and that is practically impossible. Moreover, these rules cannot anticipate threats that can enter your network via previously unknown methods. A behavior-based system, on the other hand, can detect any unusual event on the network based on dynamic behavior baselines. For example, in a rule-based system, a brute force attack alert would be issued when a certain number of failed logons are attempted and the final attempt succeeds. the problem here is that it is a tricky job to decide the failed logon threshold. In the same scenario, a behavior-based system would consider the excessive number of failed logons an anomaly and promptly issue an alert, without the need for a threshold.

UBA, used in conjunction with periphery security systems can help you improve the security posture greatly.

While firewalls and antivirus software help protect the network against external threats, UBA can track the activities of an outsider who has managed to enter the network undetected or can analyze the behavior of insiders and spot suspicious activities. Since UBA relies on behavior-based threat detection, it reduces the number of security alerts by drastically reducing the number of false positives. One of the main reasons many admins ignore their security system alerts is because the majority of them are false positives.

ADAudit Plus: An Active Directory auditing tool with UBA capability

ADAudit Plus is a real-time Active Directory auditing and reporting tool that uses UBA to identify any suspicious activity on the network. For example, if a user, who otherwise logs in at regular work hours, all of a sudden logs in at 3:00 AM, it will be recorded in the Unusual Logon Activity Time report in the Analytics section on ADAudit Plus. In addition to that, ADAudit Plus also issues real-time alerts when it detects any unusual activity on the network. Here is a sample report on unusual logon activity time from the Analytics section on ADAudit Plus:

User logon activity report

This report shows the unusual activity time along with the general start and end time of the particular user. This can help the administrator understand why it was flagged unusual and can decide whether or not it should be considered suspicious. This report can be accessed on ADAudit Plus by navigating to Analytics > Anomalous Logon Activity > Unusual Logon Activity Time.

Download ManageEngine's ADAudit Plus, to get 200+ audit reports and email alerts. It is a useful tool to understand employee behavior with regards to IT, to thwart insider and outsider attacks, and also for compliance purposes.

Download ADAudit Plus

Free, fully functional 30-day trial

More related links

✕

Native auditing becoming a little too much?

Try ADAudit Plus to audit, track, and respond to malicious activities happening inside your Windows AD & Azure environment.

Try ADAudit Plus for free
 

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

  • Active Directory
  • File servers
  • Windows server
  • Workstation
  • Compliance
  • Related Products

A single pane of glass for complete Active Directory Auditing and Reporting

Free Trial Get Quote
Back to Top