An analyst is configuring a SIEM to baseline normal user behavior and detect anomalies. The SIEM vendor calls this feature UEBA (User and Entity Behavior Analytics). What specific advantage does UEBA provide over static threshold-based detection rules?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because UEBA uses machine learning to build per-user or per-entity behavioral profiles (normal working hours, data volumes, access patterns); deviations from the individual baseline trigger alerts, catching attackers who operate below static thresholds but behave differently from the compromised user's normal pattern. A is wrong because UEBA reduces but does not eliminate false positives; behavioral models can still generate alerts for legitimate anomalous activity (travel, role changes).
Full explanation below image
Full Explanation
B is correct because UEBA uses machine learning to build per-user or per-entity behavioral profiles (normal working hours, data volumes, access patterns); deviations from the individual baseline trigger alerts, catching attackers who operate below static thresholds but behave differently from the compromised user's normal pattern. A is wrong because UEBA reduces but does not eliminate false positives; behavioral models can still generate alerts for legitimate anomalous activity (travel, role changes). C is wrong because UEBA adds analytical processing on top of existing log data; it does not reduce storage. D is wrong because UEBA requires log collection from endpoints and other sources to build behavioral models.