<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-identity-analytics-platform
description: >-
  Build identity analytics platforms that aggregate authentication telemetry, access patterns, and identity risk signals into actionable intelligence. Covers UEBA for identity, access certification analytics, entitlement mining, identity risk scoring, and anomaly detection for authentication and authorization events.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-analytics
  - UEBA
  - access-certification
  - entitlement-mining
  - risk-scoring
  - anomaly-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "DE.AE-1"
  - "DE.AE-2"
  - "DE.AE-3"
  - "DE.CM-1"
  - "DE.CM-3"
  frameworks:
  - "MITRE ATT&CK"
  - "NIST SP 800-53"
  - "Gartner ITDR"
  mitre-attack: ["T1078"]
---

# Implementing Identity Analytics Platform

## Overview

Identity analytics platforms transform raw authentication and authorization
telemetry into risk-scored intelligence. By applying UEBA models, entitlement
mining algorithms, and peer group analysis, these platforms detect compromised
identities, excessive access, and policy violations that traditional SIEM
correlation rules miss.

## Workflow

1. **Data Source Integration** — Connect IdPs, PAM, IGA, SIEM, and HR systems to analytics pipeline
2. **Identity Graph Construction** — Build entity graph linking users, accounts, groups, roles, and resources
3. **Behavioral Baseline** — Establish normal authentication and access patterns per identity and peer group
4. **Risk Scoring Engine** — Implement multi-factor identity risk scoring with configurable weights
5. **Anomaly Detection Models** — Deploy statistical and ML-based models for authentication and access anomalies
6. **Entitlement Analytics** — Mine actual access patterns vs. granted entitlements to identify over-provisioning
7. **Access Certification Intelligence** — Provide risk-ranked recommendations for access reviews
8. **Dashboard and Alerting** — Build real-time identity risk dashboards with threshold-based alerting

## Key Concepts

### Identity Risk Scoring Factors

| Factor | Weight | Data Source | Indicator |
|--------|--------|-------------|-----------|
| Authentication Anomaly | 25% | IdP logs | Impossible travel, new device, unusual time |
| Access Pattern Deviation | 20% | Application logs | First-time resource access, burst activity |
| Entitlement Risk | 20% | IGA platform | Over-provisioned, toxic combinations |
| Account Hygiene | 15% | Directory | Stale password, no MFA, dormant account |
| Threat Intelligence | 10% | TI feeds | Credential in breach database |
| Peer Group Deviation | 10% | Analytics | Access unlike role peers |

### UEBA Detection Categories

| Category | Detection | Example |
|----------|-----------|---------|
| Impossible Travel | Geo-velocity analysis | Login from NYC then London in 30 min |
| Credential Stuffing | Failed auth patterns | Distributed low-rate authentication failures |
| Session Hijacking | Session fingerprint change | User-agent or IP change mid-session |
| Privilege Escalation | Role change analytics | Self-service role addition |
| Data Exfiltration | Access volume analysis | Bulk download after hours |
| Lateral Movement | Auth chain analysis | Sequential access across unrelated systems |

### Entitlement Mining Techniques

| Technique | Purpose | Algorithm |
|-----------|---------|-----------|
| Role Mining | Discover implicit roles | K-means clustering on access patterns |
| Outlier Detection | Find over-provisioned users | Statistical deviation from peer group |
| Usage Analytics | Identify unused entitlements | Access log correlation with granted rights |
| Toxic Combination | Detect SoD violations | Rule-based constraint evaluation |
| Birthright Analysis | Validate default access | New-hire access vs. policy comparison |

## Detection Opportunities

### Identity Analytics Alert Types

- **Risk score spike**: identity risk score exceeds threshold or increases rapidly
- **Impossible travel**: authentication from geographically impossible locations within time window
- **Entitlement anomaly**: access to resources outside normal peer group pattern
- **Dormant account activation**: previously inactive account begins accessing resources
- **MITRE mapping**: T1078 (Valid Accounts), T1110 (Brute Force), T1557 (Adversary-in-the-Middle)

```yaml
title: Identity Analytics Platform Detection
id: a7fe824c-1116-4e13-8389-3f3880c7fb97
status: experimental
description: Detects suspicious activity related to implementing identity analytics platform techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1078
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

## Quick Reference

```bash
node scripts/agent.js analyze --target <scope>
```
