UEBA: Learn What's Normal, Catch What's Odd
Antivirus looks for signatures of known bad. But a real attack usually looks like legitimate activity that deviates from the norm — an admin account logging in at 3 a.m., a device reaching out to an address it has never talked to. UEBA doesn't look for "bad"; it learns what's normal for each device, and alerts on the deviation.
How it works — 5 steps
1. Collection. The agent's heartbeat already carries behavioral facts: processes, autoruns, public peers, listening ports. 2. Historization. The Worker extracts the facts and appends them to a time series (device_telemetry) — this is the cornerstone everything else rests on. 3. Learning. A learning window (14 days by default) builds a profile for each device: known processes, known peers, login accounts, typical activity hours. 4. Detection. Every heartbeat is compared to the profile, and deviations become anomalies with a severity. 5. Response. The anomalies feed into the alerts panel, with the option of automatic containment over the control channel.
Examples of anomalies we catch
- First contact with a public IP the device has never talked to (info→medium).
- A peer on a C2 list — cross-referenced against the Feodo feed (critical).
- A new unsigned process / a process running from temp/appdata (medium→high).
- New persistence — a jump in the number of autoruns / a new scheduled task (high).
- A new listening port (medium).
- Out-of-hours login / a new account / a spike in login failures (high).
Why MITRE tagging matters
Every anomaly is tagged with an ATT&CK technique — so instead of "something odd happened," you get "T1053 — Scheduled Task/Job (persistence)." This turns a single alert into part of an attack story you can investigate, document and report (including for Amendment 13 purposes).