UEBA (User and Entity Behavior Analytics)
In CSIRT-Pro, UEBA is a framework for managing scheduled detection Playbook tasks against users and entities such as servers, devices, and endpoints. When a task detects something, it can automatically create a case.
What UEBA is, and is not, in CSIRT-Pro
UEBA here means running a detection Playbook against a set of assets on a fixed interval. The detection logic lives in the referenced Playbook, for example a Sigma search or user-defined logic. CSIRT-Pro does not ship a separate engine for statistical baselining, machine-learning anomaly scoring, or geolocation anomaly detection. UEBA settings are held in a configuration document store, and tasks are run by the workflow execution platform.
Screen Layout
The UEBA screen has the following components.
- Task groups for the logical grouping of detection tasks.
- Individual tasks, where each task is a detection Playbook.
- Asset management for the monitored assets such as servers, users, and devices.
- Credential management for the authentication credentials used to reach assets.
Core Concepts
Task Groups
Related detection logic is organized into groups. For example:
- a Brute Force Detection group,
- a Privilege Escalation Detection group,
- a Data Exfiltration Detection group.
Each group contains one or more tasks that focus on a specific threat category.
Tasks
Each task is an individual detection Playbook that runs on a schedule. When the task's logic matches, the task automatically creates a case.
Assets
Assets are the entities being monitored, such as servers, user accounts, network devices, and endpoints. A task is linked to specific assets to define its monitoring scope.
UEBA Configuration
1. Enable and Disable Tasks
Toggle each task on or off to control which detection logic is active.
2. Detection Intervals
Configure how frequently each task runs.
| Interval | Description |
|---|---|
| 1 minute | Near-real-time detection |
| 5 minutes | Standard detection interval |
| 15 minutes | Moderate frequency |
| 1 hour | Low-frequency periodic checks |
| 1 day | Daily batch analysis |
| 1 week | Weekly trend analysis |
Permissions
Changing a detection interval requires the appropriate user permissions.
3. Link Assets to Tasks
- Open the task's configuration screen.
- Select the Asset Management tab.
- Search for and select the assets to monitor.
- Click Link to associate the assets with the task.
4. Credential Management
Authentication credentials for reaching monitored assets are stored securely.
- SSH keys
- API tokens
- Username and password pairs
Security
Credentials are encrypted at rest. They are shown as masked indicators in the UI.
Detection Flow
UEBA detection runs through the following steps.
- Scheduled execution. Each UEBA task runs automatically at its configured interval.
- Log analysis. The task's analysis query runs against log data held in the columnar log analytics store.
- Detection. When the Playbook's logic matches, a case is created automatically.
- Notification. Notifications are sent according to the escalation policy, for example by email, Slack, or SMS.
- Asset correlation. Linked asset information is used to identify the scope of impact.
Task Group Examples
Illustrative only
The tasks and thresholds below are examples of how detection Playbooks might be organized. They are not a bundled, pre-seeded rule set. The actual detection content depends on the Playbooks registered in your deployment.
Brute Force Detection
| Task | Logic | Interval |
|---|---|---|
| SSH Brute Force | Count failed SSH auth attempts per source IP in a 5-minute window; threshold > 10 | 5 min |
| Web Login Brute Force | Count failed web login attempts per account in a 15-minute window; threshold > 20 | 5 min |
| RDP Brute Force | Count failed RDP login events per source IP; threshold > 15 | 5 min |
Privilege Escalation Detection
| Task | Logic | Interval |
|---|---|---|
| Sudo Abuse | Detect unusual sudo commands by non-admin users | 15 min |
| New Admin Account | Detect creation of new accounts with admin privileges | 1 min |
| Permission Change | Detect changes to file or directory permissions on critical systems | 5 min |
Data Exfiltration Detection
| Task | Logic | Interval |
|---|---|---|
| Large Outbound Transfer | Detect outbound transfers over 100 MB to external IPs | 15 min |
| DNS Tunneling | Detect abnormally high DNS query volume to a single domain | 5 min |
| Off-Hours Activity | Detect data access outside normal business hours | 1 hour |
Templates
UEBA templates and template groups are registered and managed by administrators and can be distributed to organizations. An Integration can assign default UEBA groups on enablement.
Note
Templates, which are detection Playbooks, are expected to be registered during onboarding and operation. CSIRT-Pro does not ship a large pre-seeded catalog of detection rules out of the box. The available detection content depends on your configuration and contract.
Template Operations
- Browse available templates.
- Deploy templates to your organization.
- An administrator can create new templates and distribute them platform-wide through the sync API.
API Operations
UEBA can also be managed through the REST API. See the API Reference for full endpoint documentation, including the following.
GET /api/user/<user_id>/UEBA/returns the UEBA configuration.PUT /api/user/<user_id>/UEBA/updates UEBA settings.GET /api/user/<user_id>/ueba/assets/lists assets.PUT /api/user/<user_id>/ueba/assets/<asset_id>/updates an asset.POST /api/user/<user_id>/ueba/tasks/<playbook_id>/assets/link/links assets to a task.GET /api/ueba-templates/lists UEBA templates (admin).POST /api/ueba-templates/add_and_sync/creates and distributes a template (admin).