User Behavior Analysis

Also called: UBA, Credential Monitoring

Definition

User behavior analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns-anomalies that indicate potential threats.' Instead of tracking devices or security events, UBA tracks a system's users. Big data platforms are increasing UBA functionality by allowing them to analyze petabytes worth of data to detect insider threats and advanced persistent threats.

D3FEND ID: D3-UBA
Tactic: Detect
Certification relevance: CySA+GCIHGCIASecurity+

Sub-techniques

ATT&CK techniques it counters

D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.

57 techniques, 155 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 57 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

32 more in the full list