Explain like I'm five · Security

What is UEBA?

User and Entity Behavior Analytics, told as a story about a guard room that remembers what is usual for every person.

3 a.m.the vault roomthe cook (key ✓ face ✓)key's right, face's right — go on inbut… the cook, at the vault, at 3 a.m.?

The key is right and the face is right. And yet something feels wrong.Even the doorkeeper who checks three times only asks "is it really you?" The cook opening the vault at 3 a.m. is odd — but it breaks no rule.

THE DOORKEEPER'S CHECKkey matches? ✓face matches? ✓…and that's allwhen?which room?how often?never askedthe bell stays quieta stolen key, a borrowed coatif the key and face match, the doorkeeper just opens up

The doorkeeper checks the key and the face — never when, where, or how often.A thief with a stolen key and a real cook who changed sides both pass the key-and-face check. The guard room's bell only rings on fixed rules like "a thief in the vault!"

THE GUARD ROOM'S BOOK OF USUALthe cook — 5 a.m. · the kitchenthe maid — daytime · 2nd floorthe carpenter — afternoon · storeroomthe king — any time · anywherewrites it down every dayeveryone's usual is different — the guard room remembers all of itanything unlike the usual raises a score

UEBA is a guard room that remembers what is usual for every person.It reads the daily logs for weeks and writes down each person's usual when, where, and how much. Not only people — every room (machine) too.

Writes down the usualone line per person, per room
Spots the differencetime, place, how often, how much
Keeps a scorethe stranger it is, the higher it goes
High score, ring the bellsent to the guard room's big screen
key ✓ face ✓ and yet…RISK SCORE3 a.m. (usually 5 a.m.) +3the vault (usually kitchen) +4five tries in one hour +2total 9 — ring the bell!a high score rings the bellthe key was right — the walk was wrong

When the cook's key opens the vault at 3 a.m., the score climbs and the bell rings.One odd thing alone doesn't ring the bell. Odd time, odd room, odd count — the points add up. The bell goes to the big screen, and the guard room checks.

a stolen keycan't copy someone else's usualthe real cook, acting strangecarries papers out every night?the new maidno usual yet — the bell rings by mistakethe first few weeks are for learning the usual

It catches stolen keys and a real cook gone strange. In the first weeks, it also gets things wrong.This is where the picture cracks. A newcomer has no usual yet, so the bell rings by mistake. That's why a watchman still has to look at the scores.

In one breath

UEBA = a guard room that writes down the usual for every person and room, raises a score whenever a right key and right face still act unlike the usual, and rings the bell when the score is high.

User and Entity Behavior Analytics learns a behavioral baseline for users and devices from logs, scores deviations as risk, and surfaces account takeover, insider threats, and lateral movement. It usually runs alongside a SIEM.

When grown-ups say it

UEBA
The guard room that knows everyone's usual. Looks at when, where, and how much — not the key and face. For people (users) and for rooms and machines (entities).
Baseline
The line in the book. The cook: 5 a.m., the kitchen. Built by reading weeks of logs.
Anomaly detection
A walk unlike the usual. 3 a.m., the vault, five tries. No rule needed — different from usual is enough to stand out.
Risk score
Points that pile up with strangeness. One oddity stays quiet; several ring the bell. Every person carries their own score.
Account takeover
Using someone else's key to be them. You can steal a key, but not the usual. Protecting the key itself → the doorkeeper who checks three times
Insider threat
The real cook carrying papers out. Real key, real face — the doorkeeper can't catch it. Only the changed walk gives it away.
SIEM
Where the bell rings. High scores go up on the big screen. → the guard room's big screen
Learning period / false positive
No usual yet. New people and new rooms ring the bell by mistake. At first, a person has to read the scores alongside.
Next story
Bugs That Spy and Bugs That Make You Work →
Want another term as a picture book? Request →