performing-user-behavior-analytics

# Performing User Behavior Analytics ## When to Use Use this skill when: - SOC teams need to detect compromised accounts through abnormal authentication patterns - Insider threat programs require behavioral monitoring beyond rule-based detection - Impossible travel or geographic anomalies indicate credential compromise - Privileged account monitoring requires baseline deviation detection **Do not use** as the sole basis for disciplinary action — UEBA findings are indicators requiring investigation, not proof of malicious intent. ## Prerequisites - SIEM with 30+ days of authentication and access log history for baseline creation - VPN, O365, and Active Directory authentication logs normalized to CIM - GeoIP database (MaxMind GeoLite2) for location-based anomaly detection - Identity enrichment data (department, role, manager, typical work hours) - Splunk Enterprise Security with UBA module or equivalent UEBA capability ## Workflow ### Step 1: Build User Authentication Baselines Create behavioral baselines from historical data: ```spl index=auth sourcetype IN ("o365:management:activity", "vpn_logs", "WinEventLog:Security") earliest=-30d latest=-1d | stats dc(src_ip) AS unique_ips, dc(src_country) AS unique_countries, dc(app) AS unique_apps, count AS total_logins, earliest(_time) AS first_login, latest(_time) AS last_login, values(src_country) AS countries, avg(eval(strftime(_time, "%H"))) AS avg_login_hour, ...