Security Operations

UEBA

Detect anomalies without surveilling your workforce

Behavior analytics is the sharpest tool against compromised accounts and insider threats, and the most sensitive at the same time: it evaluates what people do. UEBA in isidaten is therefore built around governance. The module stays locked until a legal basis is documented. Works-agreement profiles define tenant-wide which detectors run, what evaluations refer to and how long the learning phase lasts. Personal references are pseudonymized, and every re-identification is audited. On this foundation the analytics operate: baselines per identity and entity, anomaly detectors, risk scoring with escalation and forensics for confirmed suspicion.

DSGVO
Features

Your benefits

1

Governance before analytics

Activation lock until a documented legal basis and works-agreement profiles with detector switches: co-determination is built in, not retrofitted.

2

Work pseudonymously, re-identify with an audit trail

Analysts see pseudonyms instead of names. Only substantiated suspicion justifies re-identification, and each one is logged.

3

Baselines, detectors, risk score

Identity and entity behavior is learned from SIEM events; deviations raise the risk score, up to escalation as an incident.

Capabilities

All capabilities at a glance

  • Activation lock until a documented legal basis
  • Works-agreement profiles: detector switches, evaluation scope, learning phase
  • Pseudonymization with audited re-identification
  • Baselines per identity & entity (SIEM-based)
  • Anomaly detectors & risk scoring with escalation
  • Forensics view for confirmed suspicion
Result

Behavior analytics your works council and DPO can support, because their conditions live in the module, not in an appendix.

Experience UEBA live

Schedule a no-obligation demo – we will show you the module with your own use cases.