What does UEBA primarily analyze?

• A. UEBA analyzes user and entity behaviors to detect anomalies
• B. Network packet rates
• C. Physical access logs only
• D. Firewall rule changes

Answer: (A)

UEBA centers on how people and other entities behave across systems, applications, and data. It builds baselines of normal activity for each user and for other entities (like devices, services, and applications) and then looks for deviations from those patterns. Those deviations can indicate things like account compromise, insider threats, or policy violations. This behavioral, anomaly-focused approach is what sets UEBA apart from raw network metrics or single-source logs.

Network packet rates measure how much traffic is flowing through the network, not how individual users or entities are behaving across multiple systems. Physical access logs are just one type of data source and don’t capture the broader, cross-system behavior UEBA analyzes. Firewall rule changes relate to configuration and change-management events rather than ongoing user/entity activity patterns.