Unusual does not mean malicious
This illustrative user and entity behavior analytics design highlights activity that differs from a relevant baseline. It supplements explicit detections and investigation; it does not infer intent or authorize containment. A new device, changed shift, or unusual data transfer can have a legitimate explanation.
Assume delayed telemetry, changing account ownership, shared infrastructure, and uneven history. The output must distinguish a behavioral deviation from uncertainty caused by missing data. Every finding needs enough context for a person to challenge it.
Resolve identity in time
Map source account and device identifiers to tenant-scoped entities using dated identity records. Store the evidence, confidence, and effective interval of each relationship. Evaluate an older event against the identity relationship valid at that time, rather than attaching today's owner retrospectively.
Do not merge people because they share an address, display name, or device. Shared accounts and unresolved identities remain explicit categories. Identity corrections create a new mapping version and identify affected feature windows for recomputation. This prevents an account rename or reassignment from silently changing a person's behavioral history.
Choose a meaningful comparison
Compute bounded event-time features such as authentication counts, resource diversity, or transfer volume. Record their definitions, input coverage, and lateness policy. Compare an entity with its own seasonal history and, where appropriate, a documented peer cohort. Elastic distinguishes individual and population analyses; those comparisons answer different questions.
A cohort should reflect relevant activity, such as service-account purpose or access role, without using protected personal characteristics. Require enough comparable observations before scoring. A new entity or sparse cohort receives an insufficient-history label rather than a confident score built from a misleading zero baseline.
Explain what changed
Score a feature window against a previously approved baseline snapshot. Preserve the observed value, expected range, comparison cohort, model version, identity version, and evidence references. Explain the factors that increased priority without claiming they establish the cause of the activity.
Keep anomaly magnitude, data confidence, and asset importance separate before applying a documented prioritization policy. Microsoft Sentinel's UEBA documentation describes historical and peer comparisons as inputs to investigation. In this example, related deviations form an analyst finding with visible uncertainty; a numerical score is never treated as a probability of guilt.
Manage drift and training pollution
Score incoming behavior before considering it for a later baseline update. Separate training eligibility from the live scoring path. Review suspected incidents, known outages, and major business changes before incorporating their intervals; a compromised account must not become normal merely through repetition.
Version training windows and exclusions, retain an appropriate rollback snapshot, and compare candidate baselines on held-out time periods. Elastic documents model snapshots and exceptional-event handling. Drift can also reflect a broken connector or changed feature definition. Investigate those explanations before retraining, and record reviewer disagreement instead of treating every dismissal as trustworthy training truth.
Investigate in an entity workspace
An analyst workspace anchors every view to an entity, identity version, and time interval. Show an activity timeline, score contributors, source coverage, and links to permitted evidence. Microsoft Sentinel's entity pages illustrate timelines and behavioral context; this reference design also keeps analyst notes distinct from source observations.
Lookups run asynchronously with visible pending, unavailable, denied, and completed states. An unavailable source is not an empty result. Keep late evidence identifiable by retrieval time. Case handoff preserves the selected evidence, query scope, mapping and model versions, and unresolved gaps, with access checked again at the destination.
Limit exposure and keep human review
Retain only the identity attributes and feature history needed for the stated detection purpose. Restrict profile access, audit investigator lookups, and apply deletion policies to features, snapshots, and evidence. Pseudonymous identifiers reduce casual exposure but do not make behavior anonymous.
Monitor unresolved identities, source gaps, baseline age, cohort size, score drift, and analyst review backlog. Evaluate usefulness with sampled, reviewed cases and time-separated tests; alert volume alone is not quality. Where history is sparse or behavior changes too quickly, an explicit threshold with a clear rationale may be more dependable than a learned baseline.