UEBADetect & Respond

Behaviour analytics that show their work.

Netgraph UEBA runs a 20-model catalog — 19 live, one honestly marked planned — spanning the full Gartner analytics taxonomy, from KNN outliers and K-Means peer grouping to Bayesian risk networks and streaming online learning. Every entity gets a 0–100 risk score with a human-readable rationale, risk decay and a full score ledger — explainable analytics, not a black-box number.

20-model catalog19 live62 use-cases incl. BFSIExplainable 0–100 riskFull Gartner taxonomyDPDP-aligned privacy

Book a demo →Why Netgraph →

What is UEBA (User & Entity Behaviour Analytics)?

UEBA builds a baseline of how each user, host, and service account normally behaves — when they log in, what they access, how much data they move — and scores deviations that rules can't anticipate: the credentialed insider, the compromised account acting 'almost' normally, the service account that suddenly reads a customer table. Netgraph runs 20 behaviour models across 62 use-cases and publishes an explainable 0-100 risk score for every entity — explainable meaning an analyst can see exactly which behaviours moved the score, not just a number.

What ships in the module

A full analytics stack — and every score explains itself.

20-model catalog

KNN outlier, K-Means peer grouping, PCA feature analysis, Markov sequence, HDBSCAN, STL time-series, streaming/online learning (River), DGA detection, AutoML, Bayesian risk network, sentiment analysis, Soundex/fuzzy link analysis, isolation forest, ECOD, LOF, a triage scorer and three detector primitives (first-occurrence, rarity, sequence). 19 live; a deep-learning intent model is honestly marked planned.

Explainable risk (XAI)

Per-entity 0–100 score with a human-readable rationale — which factors fired, at what weight — plus risk decay over time and a score ledger auditing every change.

62-use-case content library

A curated library of behavioural use-cases including BFSI sector packs — deploy what fits your environment instead of authoring from zero.

Peer groups that explain WHY

Peer grouping comes with a shared-host relationship graph that shows the evidence behind every grouping — you can see why two entities are peers, not just that the model says so.

Baselines & deviations

A dedicated console for per-entity baselines and their deviations — the raw material every detector primitive and model builds on.

Visual Rule Canvas

Compose behavioural rules on a visual canvas whose vocabulary is aligned to the live detectors — what you can drag is what actually runs.

Watchlists with activity logs

Watch users, entities and endpoint hosts, with per-list activity logs — focused monitoring for leavers, privileged accounts or flagged machines.

Entity Context lookup

One lookup fusing five sources — including UEM endpoint posture from the unified agent — into a single entity picture for triage and investigation.

Model registry & ops

Configurable hyperparameters and per-model enable/shadow mode, ML jobs & AIOps for training and operations, a simulation harness for validating scenarios end-to-end, and DPDP-aligned pseudonymization controls for privacy.

Explainability, first-class

A risk score you can defend in a review meeting.

When UEBA raises an entity to 87, the console shows exactly which models contributed, which behaviours deviated from which baseline, and how the score decayed and re-accumulated over time. The score ledger keeps the audit trail; the shared-host peer graph shows the comparison population; the rationale reads like an analyst wrote it.

Factor-by-factor breakdown with weights — no unexplained composite.
Risk decay and a score ledger — scores age honestly and every change is recorded.
Shadow mode lets a new model score silently before it influences risk.
The simulation harness fires labelled scenarios end-to-end — prove a detector works before you rely on it.

Functionality map

Module functions at a glance

Function	What it does	Where it lives
Behavior Analytics	The analytics overview across users and entities	UEBA ▸ Behavior Analytics
UEBA Risk	Explainable 0–100 entity risk with rationale, decay and score ledger	UEBA ▸ UEBA Risk
Baselines & Deviations	Per-entity baselines and their deviations	UEBA ▸ Baselines & Deviations
Peer Groups	K-Means peer grouping with a shared-host relationship graph explaining membership	UEBA ▸ Peer Groups
Entity Context	Fused lookup across 5 sources including UEM endpoint posture	UEBA ▸ Entity Context
Content Library	62 behavioural use-cases including BFSI sector packs	UEBA ▸ Content Library
Rule Canvas	Visual rule composition, vocabulary aligned to the live detectors	UEBA ▸ Rule Canvas
UEBA Models	Model registry: hyperparameters, enable/shadow per model; ML jobs & AIOps	UEBA ▸ UEBA Models
Watchlists	Users, entities and endpoint hosts under watch, with activity logs	UEBA ▸ Watchlists

Common questions

UEBA — asked and answered

Why do most UEBA deployments go stale, and how does Netgraph avoid it?+

Standalone UEBA tools drift because their baselines live apart from the response loop — nobody re-tunes what nobody uses. Netgraph's UEBA writes risk scores onto the same graph entities the SOC agents investigate every day, so model output is continuously exercised, validated by analysts, and fed back. Our blog post 'UEBA after the honeymoon' covers this in depth.

Is the risk scoring explainable?+

Yes — every 0-100 entity score decomposes into the specific behavioural deviations that produced it, with links to the underlying events on the graph. That matters for analyst trust and for defending actions taken on the basis of the score.

What use-cases does Netgraph UEBA cover?+

62 shipped use-cases across insider threat, account compromise, privilege abuse, data staging and exfiltration, service-account anomalies, and impossible-travel/access-pattern detection — running on 20 behaviour models.

See it live

Ask why an entity scored 87. Get an answer that reads like an analyst.

Book a demo →Browse all modules