UEBA — USER & ENTITY BEHAVIOUR ANALYTICS

The insider threat
is already inside.

Most breaches involve legitimate credentials. DKTrace UEBA detects the subtle behavioural shifts that signal a compromised account, a malicious insider, or a supply chain intrusion — before data leaves the building.

See UEBA in Action Paired with SIEM
30-day
Rolling baseline window
98.7%
True positive rate
<4 min
Mean time to risk score
83%
Alert noise reduction

How behavioural detection works

01
Collect
Logs from AD, endpoint, SaaS, cloud, email, DLP, badge systems
02
Baseline
30-day per-user ML model built automatically from raw events
03
Score
Every action scored in real-time against baseline + peer group
04
Surface
High-risk sessions surfaced to analyst queue with full evidence
05
Respond
Manual review or automated containment — configurable per policy

Core capabilities

ML Behavioural Baselines

DKTrace builds 30-day rolling baselines per user and entity. Every action is scored against that individual's normal — not a generic threshold.

Peer Group Benchmarking

Behaviour is compared against cohort peers — same role, same department, same geography. Outliers surface automatically with full evidence.

Insider Threat Detection

Detect data staging, mass downloads, after-hours access, privilege escalation, and lateral movement before exfiltration occurs.

Session Risk Scoring

Every user session receives a real-time risk score, continuously updated. High-risk sessions trigger analyst queues or automated containment.

Risk Timeline & Replay

Full chronological timeline of every suspicious action per user. One-click replay to reconstruct an attack sequence for forensics or HR.

Automated Response

When risk score breaches threshold: force MFA, lock session, notify manager, quarantine device — all configurable per policy, no manual triage.

Threats we detect

Privileged account misuse
Admin accounts accessing non-work resources, exporting data, disabling logging
Departing employee data theft
Mass downloads, cloud sync to personal storage, USB activity spikes before resignation
Account takeover
Impossible travel, credential stuffing, unfamiliar device + geolocation anomalies
Contractor overreach
Third-party accessing systems outside scope, retaining access post-contract
Compromised service accounts
Service accounts exhibiting interactive behaviour, lateral movement, new network paths
Supply chain intrusion
Vendor credentials used at unusual times, accessing production systems outside normal scope

UEBA + SIEM: Unified in DKTrace

Unlike standalone UEBA tools (Varonis, Securonix) that require a separate SIEM integration, DKTrace UEBA is natively embedded in the platform. Risk scores enrich every SIEM alert. No data export, no pipeline lag, no extra licence.

Catch the insider before the exfiltration.

30-minute demo — we'll run a live insider threat scenario on your environment profile.

Book a UEBA Demo