Data Sources for UEBA, Ranked
Not all telemetry earns its ingest cost. What each source enables, and the high-value ones most deployments skip entirely.
Data engineering
Sources, entity resolution, normalisation, time handling and enrichment. Most analytics failures are data failures, and the failure mode is silence rather than error.
6 records
Entity Resolution in Practice
One person appears as six identifiers across your logs. Until they are joined you have six thin baselines instead of one useful one.
Log Normalisation and Schemas
Every source names the same field differently. Mapping them into one schema consumes most of a deployment and decides whether it works.
Data Failures That Break Models
Analytics failures are usually data failures. Nothing errors, the dashboard stays green, and detection quietly stops working.
Time: The Quiet Killer
Timezone handling, clock skew and window boundaries break more deployments than any modelling choice, and the damage is invisible.
Enrichment That Makes Scores Usable
A deviation score without context takes twenty minutes to triage. Which fields to attach, and which you should refuse to attach.