Configure User and Entity Behavior Analytics (UEBA)

Configure UEBA Profiles

The UEBA service allows a combination of predefined and custom profiles that you can associate with the policies of a tenant. You can configure custom profiles if you do not want to use the predefined profiles. In a profile, you define parameters for the user activities that you want to monitor, such as bulk delete, bulk download, bulk upload, and bulk failed logins. 

To configure a UEBA profile:

1. Go to Configure > Advanced Security > User and Entity Behavior Analytics (UEBA) > Profiles.
   
   
   
   The following screen displays. 
   
   
    
2. Click the  Add icon to create a new UEBA profile. The following screen displays.
   
   
    
3. Click Behavior Type, and select one of the following types:
   • Bulk Delete—Monitor potentially risky users for any malicious activity that would cause data loss due to bulk delete. 
   • Bulk Download—Identify suspicious download activity from applications and instances where corporate data is stored. 
   • Bulk Upload—Detect suspicious data movement to applications and sites which could potentially expose corporate data. 
   • Bulk Failed Logins—Identify attempts to breach corporate user accounts. 
   • Impossible Travel—Detect geographically distant login activities such as, login attempts by the same user from distant locations that are practically impossible to travel across with in the duration of multiple login attempts. For example, two login activities from the same user within 10 minutes from two geographic locations that are 1000 miles apart.
   • Risky Countries—Detect user activity from potentially compromised or infected devices by identifying activity on applications and sites hosted in risky countries.
   • (For Releases 12.2.2 and later.) MITRE ATT&CK—Use MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) to identify and categorize the tactics, techniques and procedures that attackers use during a cyber attack. The MITRE ATT&CK Matrix framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world cyber threat intelligence. 
4. Enter information for the following fields, which are based on the behavior type that you select in the previous step. Note that the fields are different if you select MITRE ATT&CK for Behavior Type. The following screen displays for other types. 
   
   
    

   Field	Description
   Count of Files	Enter the number of counts for each behavior type. Based on the value for Behavior Type, the field name changes, and you enter the values for behavior type calculation: For Bulk Delete, enter the number of files in Count of Files Deleted. For Bulk Download, enter the number of files in Count of Files Downloaded. For Bulk Upload, enter the number of files in Count of Files Uploaded. For Bulk Failed Logins, enter the number of logins in Count of Failed Logins.  For Risky Countries, select the countries from Countries. For Impossible Travel, enter the number of files in Count of Files. Value: 0 through 65535.
   Time Interval and Unit Type	Enter the time interval to count each behavior type based on the Unit Type (Minutes, Hours, or Days).  Value based on Unit Type: Minutes—2 through 1440 Hours—1 through 24. Days—1 through 365.
   Sensitivity	Enter the sensitivity count for each behavior type activity, with 1 being the highest sensitivity and 5 the lowest.
   Severity	Select the severity value for the behavior type: Critical High Informational Low Medium

5. (For Releases 12.2.2 and later.) For MITRE ATT&CK, the following screen displays.
   
   
   1. Select a domain from Company Domain. The options are: 
      • All
      • Government and Diplomatic Entities
      • Transportation and Aviation
      • Manufacturing
      • Defense Industry
      • Energy and Critical Infrastructure
      • Financial Sector
      • Retail and Hospitality
      • Technology and Telecommunications
      • Education and Academic Institutions
      • Healthcare
      • Media and News Outlets
      • Gaming
        For more information, see the MITRE ATT@CK Matrix website.
   2. To read more information about each MITRE ATT@CK Matrix enterprise or technique, click the  Info icon next to each item.  For example:
      
      
   3. To select the severity for a sub-technique, click the sub-technique and select a severity that displays on the right side. The severities are Critical, High, Medium, Low, and Informational.
      
      
      When you select a severity, the sub-technique is highlighted in the color associated with the severity. For example, for Critical the color is red:
      
      
6. Click Next. In the Review and Submit screen, review the entries you made. To change an entry, click the  Edit icon and make the change.
   
   
7. In the General section, enter a name for the UEBA profile and, optionally, a description and tags.
8. To update the profile behavior, click the  Edit icon under Behavior Type. 
9. For all other sections, review the information. If you need to make changes, click the  Edit icon.
10. Click Save.

Configure UEBA Policy Rules

To configure a UEBA policy rule:

1. Go to Configure > Advanced Security > User and Entity Behavior Analytics (UEBA) > Policy Rules.
   
   
   
   The Policies screen displays.
   
   
    
2. To customize which columns display, click Select Columns, and then click the columns to select or deselect the ones that you want to display. Click Reset to return to the default column display settings. The options are:
   • Applications
   • Users
   • Security Enforcement
   • Description
   • Enabled
      
3. Click the  Add icon to create a new UEBA policy rule. The Create UEBA Rule screen displays. By default, all applications are selected.
   
   
    
4. Select the applications to include in the policy rule:
   • To select a predefined application, click the box for the application. You can use the search function to find specific applications.
   • To add a new application, click  Add New. 
5. Click Users and Groups. By default, all users are selected.
   
   
    
6. To specify which users to include in the policy rule, click Customize. The Users and Groups window displays with the User Groups tab selected by default.
   
   
    
7. Select one or more user groups to include in the policy rule.
8. Click the Users tab, and select one or more users to include in the policy rule.
9. Click the Next. In the Security Enforcement tab, select enforcement actions as desired. Note that you must select at least one security enforcement action:
   • Bulk Delete—Monitor potentially risky users for any malicious activity that would cause data loss. Enter Count of Files Deleted, Time Interval, and Unit Type; select Sensitivity and Severity.
   • Bulk Download—Identify suspicious download activity from applications and instances where corporate data is stored. Enter Count of Files Downloaded, Time Interval, and Unit Type; select Sensitivity and Severity.
   • Bulk Upload—Detect suspicious data movement to applications and sites which could potentially expose corporate data. Enter Count of Files Uploaded, Time Interval, and Unit Type; select Sensitivity and Severity.
   • Bulk Failed Logins—Identify attempts to breach corporate user accounts. Enter Count of Failed Logins, Time Interval, and Unit Type; select Sensitivity and Severity.
   • Impossible Travel—Detect geographically distant login activities. For example, login attempts by the same user from distant locations in a short time.
   • Risky Countries—Detect user activity from potentially compromised or infected devices by identifying activity on applications and sites hosted in risky countries.
     
     
10. Click Review and Deploy and review the entries. Click the Edit icon in each section to make changes, if desired.
    
    
     
11. In the General section, enter a name for the UEBA rule and, optionally, a description and tags.
12. For all other sections, review the information. If you need to make changes, click the Edit icon.
13. Click Save.

Publish Tenant UEBA Configuration

After you configure UEBA profiles and policy rules for a tenant, you publish advanced security cloud (ASC) information, which shares the UEBA details to the configuration manager and the clusters that listen to the configuration manager, including the UEBA cluster. The publish information goes from the Concerto node to the Director node, and then to the configuration manager.

To publish the tenant UEBA configuration:

1. Click Publish on the top of the UEBA profiles or policy rules screen.
   
   
2. Select Advanced Security Cloud and click Publish. For more information, see Publish SASE Gateways.