Which approach uses behavior analytics to detect unusual patterns across users and devices?

Which approach uses behavior analytics to detect unusual patterns across users and devices?

• A. FIM
• B. UEBA
• C. EDR
• D. HIDS

Answer: (B)

Behavior analytics across users and devices focuses on how people and machines behave, building normal activity baselines and flagging deviations that could signify threats. This approach is known as User and Entity Behavior Analytics. By analyzing signals from multiple sources—user accounts, devices, applications, and network activity—UEBA can detect unusual login patterns, access to sensitive resources from new locations, atypical sequences of actions, or devices showing abnormal behavior. It’s especially powerful for spotting compromised credentials, insider threats, or post‑compromise activity that might not trigger traditional rule‑ or signature‑based alerts. Compared to other options, file integrity monitoring watches for changes to files rather than how users and devices behave across the environment; endpoint detection and response focuses on telemetry from individual endpoints; and host-based intrusion detection monitors activities on a single host. The strength of UEBA lies in its cross‑entity, cross‑device view, enabling detection of anomalies that emerge only when looking at the bigger picture.

Behavior analytics across users and devices focuses on how people and machines behave, building normal activity baselines and flagging deviations that could signify threats. This approach is known as User and Entity Behavior Analytics. By analyzing signals from multiple sources—user accounts, devices, applications, and network activity—UEBA can detect unusual login patterns, access to sensitive resources from new locations, atypical sequences of actions, or devices showing abnormal behavior. It’s especially powerful for spotting compromised credentials, insider threats, or post‑compromise activity that might not trigger traditional rule‑ or signature‑based alerts.

Compared to other options, file integrity monitoring watches for changes to files rather than how users and devices behave across the environment; endpoint detection and response focuses on telemetry from individual endpoints; and host-based intrusion detection monitors activities on a single host. The strength of UEBA lies in its cross‑entity, cross‑device view, enabling detection of anomalies that emerge only when looking at the bigger picture.