{"id":3328,"date":"2021-04-16T15:12:00","date_gmt":"2021-04-16T19:12:00","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=3328"},"modified":"2021-04-16T15:12:00","modified_gmt":"2021-04-16T19:12:00","slug":"how-ueba-helps-endpoint-security-monitoring","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/","title":{"rendered":"How UEBA Helps Endpoint Security Monitoring"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-2716\" src=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg\" alt=\"How UEBA Helps Endpoint Security Monitoring\" width=\"800\" height=\"400\" srcset=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg 800w, https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD-300x150.jpg 300w, https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD-768x384.jpg 768w, https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD-540x270.jpg 540w, https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD-162x81.jpg 162w, https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD-360x180.jpg 360w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and endpoint protection platform?\u00a0<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\"><div class=\"box box3\">ALERT: Our <a href=\"https:\/\/solutionsreview.com\/security-information-event-management\/siem-buyers-guide-security-information-and-event-management\/\" target=\"_blank\" rel=\"noopener noreferrer\">Buyer\u2019s Guide for SIEM<\/a> helps you evaluate the best solutions for your business use case and features profiles of the leading profiles, as well as a category overview of the marketplace and Bottom Line Analysis.<\/div><\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">UEBA is a critical component of modern SIEM solutions and enterprise-level cybersecurity. <\/span><a href=\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-ueba-samir-jain-of-logrhythm\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400\">Samir Jain<\/span><\/a><span style=\"font-weight: 400\">, Senior Product Manager of Security Analytics at SIEM vendor <\/span><a href=\"https:\/\/logrhythm.com\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400\">LogRhythm<\/span><\/a><span style=\"font-weight: 400\">, shared a relevant definition of UEBA in an interview with Solutions Review: \u201c[It] provides visibility into user behavior to prevent theft or corruption of company information by both trusted insiders and entities and by malicious outsiders masquerading as insiders.\u201d\u00a0<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">Behaviors indicative of suspicious activity can vary, and often includes:\u00a0<\/span><\/p>\n<ul style=\"text-align: justify\">\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Abnormal Logon\/Logoff Time<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Files Accessed By Unauthorized Employees<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Unusual Email Usage<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Poor Job Performance<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Expressions of Discontentment<\/span><\/li>\n<\/ul>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">As a result, UEBA can monitor insider threats as well as external actors controlling users\u2019 accounts. So the connection between UEBA and identity management is obvious; both provide a component of continuous monitoring beyond the login portal.\u00a0\u00a0<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">However, that doesn\u2019t answer the connection between UEBA and endpoint security monitoring. The answer lies in one of the letters that comprise UEBA: entity.\u00a0<\/span><\/p>\n<h2 style=\"text-align: justify\"><b>UEBA, Endpoint Security Monitoring, and Device Identity<\/b><\/h2>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">UEBA doesn\u2019t just monitor users, but the device they operate and use to navigate and interact with the network. This matters in a few ways:\u00a0<\/span><\/p>\n<ul style=\"text-align: justify\">\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Hackers can and often do plant malware and other cyber-attacks beneath the notice of users. These can include cryptojacking software and ransomware payloads waiting for access to more central databases.\u00a0<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Devices may have become bots without users&#8217; knowledge, allowing threat actors to communicate with devices at any time and take control of them.\u00a0<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Hackers may steal or subvert devices and use them to log in. Given that so many authentication protocols take the device used into account, this could prove a critical means to avoid detection.\u00a0<\/span><\/li>\n<\/ul>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">Looking for signs of these kinds of subversive attacks involves looking for suspicious behaviors on each device as it connects and interacts with the network. With UEBA partnered with endpoint security monitoring, you can find these behaviors faster and thus mitigate more attacks.\u00a0<\/span><\/p>\n<p style=\"text-align: justify\"><span style=\"font-weight: 400\">For more, check out the <a href=\"https:\/\/solutionsreview.com\/security-information-event-management\/siem-buyers-guide-security-information-and-event-management\/\" target=\"_blank\" rel=\"noopener\">SIEM Buyer\u2019s Guide<\/a> and the <a href=\"https:\/\/solutionsreview.com\/endpoint-security\/free-endpoint-protection-buyers-guide\/\" target=\"_blank\" rel=\"noopener\">Endpoint Security Buyer\u2019s Guide<\/a>.\u00a0\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400\"><br \/>Widget not in any sidebars<br \/><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and endpoint protection platform?\u00a0 UEBA is a critical component of modern SIEM solutions and enterprise-level cybersecurity. Samir Jain, Senior Product Manager of Security Analytics at SIEM vendor LogRhythm, shared a relevant definition of [&hellip;]<\/p>\n","protected":false},"author":41,"featured_media":2716,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1,3],"tags":[95,1290,150,22,280],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How UEBA Helps Modern Endpoint Security Monitoring<\/title>\n<meta name=\"description\" content=\"How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and EPP?\u00a0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How UEBA Helps Modern Endpoint Security Monitoring\" \/>\n<meta property=\"og:description\" content=\"How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and EPP?\u00a0\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools &amp; Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2021-04-16T19:12:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/\",\"name\":\"How UEBA Helps Modern Endpoint Security Monitoring\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg\",\"datePublished\":\"2021-04-16T19:12:00+00:00\",\"dateModified\":\"2021-04-16T19:12:00+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and EPP?\u00a0\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg\",\"width\":800,\"height\":400,\"caption\":\"How UEBA Helps Endpoint Security Monitoring\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How UEBA Helps Endpoint Security Monitoring\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools &amp; Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics &amp; SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How UEBA Helps Modern Endpoint Security Monitoring","description":"How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and EPP?\u00a0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/","og_locale":"en_US","og_type":"article","og_title":"How UEBA Helps Modern Endpoint Security Monitoring","og_description":"How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and EPP?\u00a0","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/","og_site_name":"SIEM Tools &amp; Security Event Management | Solutions Review","article_published_time":"2021-04-16T19:12:00+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/","name":"How UEBA Helps Modern Endpoint Security Monitoring","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg","datePublished":"2021-04-16T19:12:00+00:00","dateModified":"2021-04-16T19:12:00+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"How does user and entity behavioral analysis (UEBA) help with endpoint security monitoring? How does it represent a critical bridge between SIEM and EPP?\u00a0","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/07\/2019-SIEM-CEO-MAIN-MOD.jpg","width":800,"height":400,"caption":"How UEBA Helps Endpoint Security Monitoring"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-ueba-helps-endpoint-security-monitoring\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"How UEBA Helps Endpoint Security Monitoring"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools &amp; Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics &amp; SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/3328"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=3328"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/3328\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/2716"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=3328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=3328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=3328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}