Viewing UEBA Metrics
User and Entity Behavior Analytics (UEBA) software analyzes user activity data from logs, network traffic and endpoints. It correlates this data with threat intelligence to identify activities/behaviours that might indicate a malicious presence in your environment.
Pulse One supports the collection and display of UEBA metrics.
To view UEBA metrics, you must install an analytics-enabled license.
To view metrics, select the Dashboard tab, and then select the UEBA tab. For example:
In this example, there are no active (current) anomalies, but there are many reported anomalies across two geographical areas.
The administrator can view the following information:
•The map location from which the anomaly occurred.
•A graph of anomaly numbers across time.
•The top five users with adaptive authentication.
•The top five devices with potential malware.
•The top five devices with anomalous traffic.
You can also view a pair of analytics reports for UEBA, see Viewing the UEBA Analytics Reports.
Click Download Report to create and download a multi-page PDF report that includes each widget that currently displays a populated graph. To send the graph via email, enter an email address and click Send Report. See Exporting Dashboard Information.