Index
Library
Forty-two records covering behavioural analytics end to end. Every record states its assumptions and where the method fails, because a technique described without its blind spots is not usable. Browse by section, or by the telemetry a technique requires.
All 42 records
Grouped by section. Each record appears once. Descriptions are on the section pages, and there is also an index by data source.
What UEBA is, what an entity is, what a baseline actually models, and how a score is assembled. Start here if the vocabulary is new or if the difference between UEBA and correlation rules is unclear.
Sources, entity resolution, normalisation, time handling and enrichment. Most analytics failures are data failures, and the failure mode is silence rather than error.
Statistical baselines, unsupervised models, features, sequences and relationship analytics. What each method can see, what it cannot, and how to tell which you need.
- Statistical Baselines vs Machine LearningAnalysis
- Rare Is Not AnomalousExplainer
- Feature Engineering for BehaviourProcedure
- Unsupervised Detection: LimitsAnalysis
- Labels: Using Analyst JudgementAnalysis
- Sequence and Session AnalyticsAnalysis
- Detecting Lateral MovementProcedure
- Cold Start: Entities With No HistoryProcedure
- Seasonality and the Business CalendarReference
- Modelling Privileged UsersProcedure
Tuning, alert volume, triage, feedback loops, drift and measurement. Review capacity is the binding constraint on every deployment, and most of this section is about respecting that.
- Tuning a UEBA DeploymentProcedure
- Alert Volume and Review CapacityProcedure
- How to Investigate a Risk ScoreProcedure
- Feedback Loops That Improve DetectionProcedure
- Measuring Quality Without Ground TruthAnalysis
- Base Rates: The Arithmetic Nobody ShowsAnalysis
- Model Drift and RetrainingProcedure
- Running a UEBA Proof of ConceptChecklist
- Fitting UEBA Into an Existing SOCProcedure
- Testing Detection With Red TeamsProcedure
Privacy obligations, bias in behavioural models, explainability requirements, minimisation and the controls on who may look at whom.
Why deployments fail, what to ask vendors, what small teams can do without a platform, and where the field is heading.