User & Entity Behavior Analytics (UEBA)

How UEBA Works

UEBA runs in two explicit phases that you trigger from the console: Compute Baseline and Run Detection. Both operate only on your own organization's data.

1. Baseline

Computing a baseline looks back over a 14-day window and, for each entity and metric, derives simple statistics — mean, stddev, min, max, and sample count. Baselines are computed from your SIEM events (per-user) and EDR events (per-host) and stored as one row per entity + metric combination. Re-running it upserts the existing baselines.

2. Detection

Running detection compares each entity's activity over the last 24 hours against its stored baseline. For every metric it computes a z-score — how many standard deviations the observed value sits from the baseline mean:

• A deviation of 2.5σ or greater is recorded as an anomaly. Anything below that is ignored.
• Each anomaly gets a risk score using the formula min(100, round(z × 15)), so a z of 4.0 → risk 60, a z of 6.7+ saturates at 100.
• Baselines whose standard deviation is zero are skipped (no meaningful deviation can be computed).

3. Escalation

When an anomaly's risk score is 70 or higher, UEBA also creates an Alert (source ueba-engine, severity High, or Critical at risk ≥ 85) and hands it to the SOAR engine, which runs any matching playbooks automatically.

Entity risk rollup

The console groups anomalies by entity. Each entity's displayed risk score is the maximum risk across its open anomalies, alongside a count of how many anomalies it has.

Tracked Metrics

Three behavioral metrics are baselined and evaluated. Each ties to a specific data source and observation.

Score fields

Every anomaly row carries the full picture behind its score:

• Observed (observedVal) — the measured value over the last 24h.
• Expected (expectedMean) — the baseline mean.
• Deviation (zScore) — standard deviations from the mean, shown as e.g. 3.4σ.
• Risk (riskScore) — 0–100, from min(100, round(z × 15)).
• Status — new, reviewed, or false_positive.

Risk is color-banded in the UI: 80+ critical, 60–79 high, 40–59 medium, below 40 low.

Running an Analysis

1. Open UEBA. The header shows how many entities are monitored and how many anomalies are currently active (status new).
2. Click Compute Baseline. A toast confirms how many metrics were baselined.
3. Click Run Detection to score the last 24 hours against those baselines. The lists refresh when it finishes.

Entities and Anomalies tabs

• Entities — a card per flagged entity (👤 user or 🖥 host) showing its rollup risk score, a risk bar, and its anomaly count. Clicking a card opens its top open anomaly.
• Anomalies — a table of open anomalies (risk, entity, metric, description, z-score, age) sorted by risk. Each row has an inline Dismiss that marks it a false positive. Clicking a row opens the triage modal.

The triage modal

Opening an anomaly shows a full diagnostic view:

• Observed / Expected / Deviation summary tiles.
• Risk Score Breakdown — the z-score, the exact formula, the resulting score, and how many other open anomalies the entity has.
• Activity Timeline (last 30 days) — the real events behind the score, pulled from the same sources the detector reads: SIEM events for users (with an auth-failure count), EDR events for hosts (with a critical/high count).
• GuardFox AI Diagnostics — a plain-language explanation tailored to the metric type.

Triage actions

• Contain Host (EDR) (hosts only) — looks up the matching enrolled EDR agent by hostname and sends it a quarantine command. If no agent is enrolled for that host, the modal says so.
• Escalate to Ticket — opens an incident with the anomaly's details and a severity mapped from its risk score.
• Dismiss (FP) — marks the anomaly a false positive.

Endpoints

All UEBA endpoints are session-authenticated app routes (call them from a signed-in session) and are scoped to your organization.

Compute baselines

POST /api/ueba/baseline rebuilds baselines over the 14-day window and returns the number computed. GET returns the stored baselines with parsed statistics.

curl -X POST https://portal.guardfoxsecurity.com/api/ueba/baseline
# -> { "computed": 12 }

Run detection

POST /api/ueba/anomalies scores the last 24h against current baselines, persists any anomalies (z ≥ 2.5), and escalates those with risk ≥ 70.

curl -X POST https://portal.guardfoxsecurity.com/api/ueba/anomalies
# -> { "detected": 3, "anomalies": [ ... ] }

List anomalies

GET /api/ueba/anomalies returns anomalies plus the per-entity risk rollup. Optional query params: status (defaults to new; pass all for every status) and entityId to filter to one entity.

curl "https://portal.guardfoxsecurity.com/api/ueba/anomalies?status=all"
# -> { "anomalies": [ ... ], "entities": [ { "entityId", "entityType", "riskScore", "anomalyCount" } ] }

Update anomaly status

PATCH /api/ueba/anomalies sets the status of one anomaly (e.g. dismiss as a false positive). Requires id.

curl -X PATCH https://portal.guardfoxsecurity.com/api/ueba/anomalies \
  -H "Content-Type: application/json" \
  -d '{"id":"","status":"false_positive"}'

Entity timeline

GET /api/ueba/timeline returns up to 25 of the entity's most recent events from the last 30 days. Both entityId and entityType (user or host) are required.

curl "https://portal.guardfoxsecurity.com/api/ueba/timeline?entityId=jdoe&entityType=user"
# -> { "events": [ ... ], "summary": { "totalEvents", "authFailures", "windowDays": 30 } }