<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-user-behavior-analytics
description: >-
  Implement user and entity behavior analytics (UEBA) to detect insider threats,
  compromised accounts, and anomalous activity. Covers baseline profiling,
  statistical modeling, risk scoring, and alert generation.
domain: cybersecurity
subdomain: blue-team
tags:
  - ueba
  - insider-threat
  - anomaly-detection
  - user-analytics
  - risk-scoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing User Behavior Analytics

## Overview

User and Entity Behavior Analytics (UEBA) establishes behavioral baselines for
users and entities, then detects deviations that may indicate compromised accounts,
insider threats, or policy violations. Unlike signature-based detection, UEBA
identifies unknown threats through statistical anomaly detection.

## Prerequisites

| Requirement | Install |
|---|---|
| SIEM with UEBA module | Splunk UBA, Elastic ML, Sentinel UEBA |
| Authentication logs | AD/Azure AD sign-in logs |
| Activity logs | File access, email, VPN, badge access |
| Python 3.10+ | Statistical analysis scripts |
| pandas / scikit-learn | `pip install pandas scikit-learn` |

## Key Concepts

### Behavioral Dimensions

| Dimension | Data Source | Baseline |
|---|---|---|
| Login time | Authentication logs | Typical login hours per user |
| Login location | Geolocation of source IP | Normal geographic regions |
| Access patterns | File/app access logs | Usual resources accessed |
| Data volume | DLP/proxy logs | Normal download/upload volume |
| Peer group | HR/AD group membership | Activity compared to peers |
| Privilege usage | Admin action logs | Normal vs. anomalous admin ops |

### Risk Scoring Model

```python
# Composite risk score from multiple behavioral signals
risk_factors = {
    "impossible_travel": 30,       # Login from two locations too far apart
    "unusual_login_time": 15,      # Login outside normal hours
    "first_time_access": 10,       # Accessing resource for first time
    "excessive_downloads": 25,     # Download volume > 3 std deviations
    "privilege_escalation": 20,    # New admin actions
    "failed_auth_spike": 15,       # Multiple failed logins
    "peer_group_deviation": 10,    # Activity unlike peer group
}
# risk_score = sum of triggered factors (0-100+)
# Thresholds: Low <30, Medium 30-60, High 60-80, Critical >80
```

### Detection Queries

```spl
| -- Impossible travel: logins from distant locations within short time
index=auth action=success
| iplocation src_ip
| sort 0 user, _time
| streamstats current=f last(City) AS prev_city, last(_time) AS prev_time by user
| eval time_diff=(_time - prev_time) / 3600
| where time_diff < 2 AND City != prev_city AND isnotnull(prev_city)
| table user, _time, City, prev_city, time_diff, src_ip

| -- First-time resource access
index=fileaccess
| stats earliest(_time) AS first_access, count by user, resource
| where first_access > relative_time(now(), "-24h")
| sort -count

| -- Abnormal data download volume
index=proxy action=download
| stats sum(bytes_out) AS total_bytes by user
| eventstats avg(total_bytes) AS avg_bytes, stdev(total_bytes) AS std_bytes
| eval zscore=(total_bytes - avg_bytes) / std_bytes
| where zscore > 3
| sort -zscore
```

### Sigma Rule for UEBA Alert

```yaml
title: Login from Multiple Countries Within Short Timeframe
id: f6a7b8c9-0d1e-2f3a-4b5c-6d7e8f9a0b1c
status: experimental
description: Detects user authenticating from multiple countries within 2 hours
logsource:
  category: authentication
  product: azure
detection:
  selection:
    EventID: 'SignInLogs'
    ResultType: 0
  condition: selection
  timeframe: 2h
falsepositives:
  - VPN users appearing to originate from VPN gateway countries
  - Users with legitimate multi-region travel
level: high
tags:
  - attack.initial_access
  - attack.t1078
```

## Workflow

1. **Collect identity data** — Aggregate auth, access, and activity logs
2. **Build baselines** — Profile normal behavior per user over 30-day window
3. **Define anomaly thresholds** — Set statistical thresholds (z-score, percentile)
4. **Implement risk scoring** — Assign weights to behavioral anomalies
5. **Create peer groups** — Group users by role, department, location
6. **Deploy detections** — Alert on risk score exceeding threshold
7. **Tune** — Adjust weights and thresholds based on false positive rate
8. **Investigate** — Triage high-risk users through investigation workflow

## Verification

| Check | Method |
|---|---|
| Baselines established | User profiles contain 30+ days of data |
| Anomalies detected | Test with known-anomalous behavior |
| Risk scores calculated | User risk scores populating in SIEM |
| Peer groups accurate | Groups align with organizational structure |
| False positive rate | <5% of alerts are false positives after tuning |

## References

- [Splunk UBA Documentation](https://docs.splunk.com/Documentation/UBA)
- [Microsoft Sentinel UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics)
- [MITRE ATT&CK T1078 Valid Accounts](https://attack.mitre.org/techniques/T1078/)
- [NIST SP 800-53 AC-2 Account Management](https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/)
