Anticipate identity, data and infrastructure risks

Spotting Malicious Activities Early On

Behavior Analytics builds baselines for normal behavior for every user, peer group, and entity in the network instead of applying predefined rules for standard actions. Logpoint’s UEBA technology identifies deviations in behavioral patterns, which are not necessarily immediately obvious and therefore often go unnoticed, to spot risk of malicious activities early on.

Enhancing Incident Investigation

With automatically calculated risk scores and high-fidelity incident prioritization, investigations become more meaningful. The closer the score is to 100, the riskier the behavior. Analysts always know which incident to look into first. Along with shorter detection times, Behavior Analytics provides more actionable evidence during investigations and higher efficacy and accuracy of the alerts and incidents generated. 

Facilitating the Response

With more context about the possible threat and the anomalies, it’s easier for analysts to know how to respond. As Behavior Analytics seamlessly integrates with Automation and Case Management, you can perform in-depth investigations and set up automated response processes.

SOC teams work smarter and focus on threats that matter because, as soon as there’s the suspicion of malicious activity in a user or entity, an automatic triage process starts to check if the user is whitelisted and block them in case of a possible threat.

External Threats

Deviations in user and entity behavioral patterns, such as transferring abnormal amounts of data or accessing files that they don’t usually have access to suggest that an has been compromised by an external threat. Because they use legitimate credentials, acquired by brute force attacks or stealing, it’s not easy to uncover them without UEBA.

Compromised Accounts

Compromised accounts are the result of outsiders who have gained access to an insider’s account by stealing their credentials, often through phishing. The outsider can lure an employee to click on a link or open an email attachment that contains a virus to infiltrate themselves.

Advanced Persistent Threats

An adversary gains unauthorized access to a computer network and remains undetected for an extended period. Once they have infiltrated the network, they will try to create backdoors, so it’s crucial to monitor any abnormal behavior in users and entities. 

MITRE ATT&CK

All anomalies detected by our UEBA are mapped to the MITRE ATT&CK framework, an industry-standard classification of adversarial tactics and techniques based on real-world observations of different cyberattacks.

Logpoint Behavior Analytics matches the machine learning algorithms to practical scenarios rather than non-cohesive, singular items of interest. This means that analysts quickly get an overview of the threat landscape to easily track the stages of an attack. By combining risk scoring with MITRE tags on anomalies, analysts prioritize their investigation and focus on the most critical incidents.