A system that provides automated identification of suspicious activity by user accounts and computer hosts.

A system that provides automated identification of suspicious activity by user accounts and computer hosts.

• A. UEBA
• B. SIEM
• C. FIM
• D. HIDS

Answer: (A)

The concept being tested is User and Entity Behavior Analytics. It focuses on automatically identifying suspicious activity by both people (user accounts) and machines (computer hosts) by learning what normal behavior looks like and flagging deviations as potential threats. UEBA builds baselines for individuals and devices, then uses analytics or machine learning to detect unusual login patterns, access across unusual times or locations, atypical file or data access, lateral movement, privilege abuse, and other risky sequences of actions. Those detections are typically scored to prioritize investigations and can trigger automated responses or feed alerts into broader security workflows. This differs from SIEM, which is about collecting and correlating logs from many sources to detect incidents; it emphasizes event aggregation and correlation rather than modeling normal behavior. File Integrity Monitoring focuses on detecting changes to files and configurations. Host-based Intrusion Detection System concentrates on monitoring a single host for known threats, not necessarily across users and hosts as a unified behavior profile.

The concept being tested is User and Entity Behavior Analytics. It focuses on automatically identifying suspicious activity by both people (user accounts) and machines (computer hosts) by learning what normal behavior looks like and flagging deviations as potential threats. UEBA builds baselines for individuals and devices, then uses analytics or machine learning to detect unusual login patterns, access across unusual times or locations, atypical file or data access, lateral movement, privilege abuse, and other risky sequences of actions. Those detections are typically scored to prioritize investigations and can trigger automated responses or feed alerts into broader security workflows.

This differs from SIEM, which is about collecting and correlating logs from many sources to detect incidents; it emphasizes event aggregation and correlation rather than modeling normal behavior. File Integrity Monitoring focuses on detecting changes to files and configurations. Host-based Intrusion Detection System concentrates on monitoring a single host for known threats, not necessarily across users and hosts as a unified behavior profile.