Statistical Baselines vs Machine Learning
The choice matters less than vendors imply and more than sceptics allow. What each approach buys, and where the boundary really is.
Detection methods
Statistical baselines, unsupervised models, features, sequences and relationship analytics. What each method can see, what it cannot, and how to tell which you need.
10 records
Rare Is Not Anomalous
Most of what a UEBA system flags is rare and entirely legitimate. This distinction is the largest source of false positives there is.
Feature Engineering for Behaviour
Features decide what a model can possibly see. Choosing them badly is how a technically correct deployment detects nothing useful.
Unsupervised Detection: Limits
Most UEBA runs unsupervised because labelled attack data does not exist. That constraint shapes everything the system can achieve.
Labels: Using Analyst Judgement
Analyst decisions are the only labels you will ever have. Capturing them turns a static deployment into one that actually improves.
Sequence and Session Analytics
Order carries information that counting discards. The main way to catch patterns where every individual step looks unremarkable.
Detecting Lateral Movement
Lateral movement is a property of the relationship graph, not of any entity. Detecting it needs pair modelling most deployments skip.
Cold Start: Entities With No History
A model with no history has nothing to compare against. The first weeks are when detection is weakest and risk is often highest.
Seasonality and the Business Calendar
Behaviour has weekly, monthly and annual rhythms. A model blind to them repeats the same false positives on the same dates forever.
Modelling Privileged Users
Administrators generate the noise that gets them excluded, which removes monitoring from the accounts with the most access.