Behavioral Analytics & UEBA
Baselines built from your users, not global averages
ManySignal builds a continuous behavioral profile for every user, service account, and workload — tracking access patterns, API call volumes, login geographies, and data movement. Deviations score against each entity's own history, not a population mean.
How behavioral baselines are built
Event stream ingestion
Auth events, API calls, data access records, and endpoint telemetry arrive normalized. Each event is tagged with the resolved entity ID, source, and a timestamp accurate to the millisecond.
Feature extraction
The baseline worker extracts time-of-day distribution, geographic clustering, API call frequency per service, data volume per day, and authentication method mix. Features are computed over rolling 30- and 90-day windows.
Profile storage
Profiles are stored as time-series summaries, not raw events. A profile for a user with six months of history occupies under 50 KB and can be retrieved in under 10 ms by detection rules and AI agents.
Deviation scoring
At alert time, the current event is compared against the profile at the time of the event. Scores combine z-score deviation, frequency rarity, and asset criticality weighting. The scoring model is explained — not a black box — so analysts can understand exactly which signals drove a high score.
Verdict and enrichment
The deviation score, feature breakdown, and historical precedent ("this user has logged in from the UK twice before") are attached to the alert as structured context before the triage agent evaluates it.
What UEBA catches that rules alone miss
Static thresholds generate noise. Per-entity baselines surface the signal.
Credential stuffing at low velocity
A rule looking for 10 failed logins in 60 seconds misses an attacker trying one credential per hour across thousands of accounts. UEBA flags the account-level deviation immediately.
Privilege creep abuse
A service account that has accumulated permissions over 18 months suddenly using them for the first time is statistically anomalous against its own baseline — even if each individual permission was legitimately granted.
Insider data staging
A user who downloads 50 files per day suddenly downloading 4,000 on a Friday afternoon scores a high volume deviation, regardless of whether the files individually trigger a DLP rule.
Account sharing
Two geographically impossible concurrent sessions from the same account are detected using travel-time physics — not a static impossible-travel rule that fires on VPN endpoints.
API key abuse
Service accounts that call GetObject once a week suddenly listing and downloading entire prefixes stand out against their own frequency profile rather than a generic threshold.
Slow reconnaissance
Enumeration spread across 14 days is invisible to window-based rules. UEBA accumulates the frequency signal over the full profile window and flags the sustained deviation.
Behavioral Analytics — FAQ
How long does it take for baselines to be useful?
Baselines begin scoring after 7 days of data per entity. The UI shows a confidence indicator — low, medium, high — so analysts know when a score is based on a mature profile versus early data.
Can UEBA scores be tuned per entity or group?
Yes. You can adjust deviation sensitivity thresholds per entity tag (e.g., lower sensitivity for privileged accounts that legitimately access many resources), suppress specific feature signals, or require a minimum confidence level before a score contributes to alert priority.
Does behavioral analytics apply to non-human identities?
Yes. Service accounts, API keys, OAuth clients, and Lambda execution roles all receive behavioral profiles. Non-human identities often have more consistent patterns, making deviations especially high-signal.
Is there a risk of baselines being poisoned by slow attackers?
Baselines use point-in-time profiles: the score at alert time compares against the profile as it existed before the event, not the current profile. Gradual drift can be surfaced by the trend detection layer, which flags profiles that have shifted significantly over 30 days.
Does ManySignal's UEBA replace a standalone UEBA product like Exabeam or Securonix?
For most teams, yes. ManySignal's per-entity baselines cover the core UEBA scenarios — credential abuse, insider threat, account sharing, privilege escalation, and data staging — without a separate licence or data pipeline. The key difference is that UEBA scores feed directly into the agentic triage agent rather than producing yet another dashboard.
How many entity types receive behavioral profiles?
User accounts, service accounts, API keys, OAuth clients, cloud roles (AWS IAM, Azure managed identity), workload identities (Kubernetes service accounts), and device accounts. Each entity type has a tailored feature set appropriate to its typical usage pattern.
How are UEBA features explained to analysts?
Each deviation score includes a feature breakdown: which signals contributed (volume, geography, time-of-day, API pattern), the magnitude of each deviation from the entity's own baseline, and historical precedents for comparison. There is no opaque score-only output.
Can behavioral analytics detect threats that have no prior MITRE ATT&CK mapping?
Yes. Deterministic rules require known-bad patterns; behavioral baselines detect statistical anomaly regardless of whether the behaviour maps to a catalogued technique. This is particularly valuable for novel insider threat patterns and zero-day lateral movement paths.
What is the performance impact of per-entity baseline computation at scale?
Baseline computation runs asynchronously in the data platform layer, not inline with event processing. Organisations with 100,000+ entities have validated sub-10ms profile retrieval at detection time. Baseline storage is compact — under 50 KB per entity for a six-month profile.
See your own user risk scores
Connect your IdP in minutes and watch behavioral anomaly scores appear on your real identity data.