User & Entity Behavior Analytics (UEBA)

How it compares

UEBA usually comes as part of a SIEM or a data security platform. Compare the quality of the baselines, the alert volume, and how easily analysts can investigate a flagged user.

Why it works

Insider threats and compromised accounts often look normal to rule-based tools. Behavioral baselines surface what is unusual.

What to look for

• It should have a low false-positive rate after tuning.
• It should provide timelines that make investigations fast.
• It should cover your key data sources.

Products I track for User & Entity Behavior Analytics (UEBA)

• ExabeamRecommended
• Securonix
• Microsoft Sentinel
• Splunk
• Varonis

More in Breach & loss reduction

• DMARC
• Single sign-on (SSO)
• Identity Threat Detection and Response (ITDR)
• Anti-fraud & bot protection
• SOAR / security automation
• Cloud Access Security Broker (CASB)
• Account takeover protection
• Secure Web Gateway (SWG)
• Zero-Trust Network Access (ZTNA)
• Dynamic Application Security Testing (DAST)
• Cloud Security Posture Management (CSPM)
• Immutable storage

← Back to the full checklist