RSA NetWitness UEBA

Spot insider threats and external attackers exploiting compromised credentials BEFORE those activities lead to a data breach. RSA NetWitness UEBA:

  • Leverages user, network AND endpoint behavior profiling to identify abnormal user behaviors
  • Detects abuse and misuse of privileged accounts, brute force attacks, account manipulation and other malicious activities
  • Requires no customization, rule authoring or ongoing care, tuning, rule creation or adjustment

In addition, RSA NetWitness UEBA Essentials is a free content pack to all RSA NetWitness Platform customers to leverage advanced correlation rules to identify anomalies in user behavior.

What Is UEBA?

UEBA, which stands for user and entity behavior analytics, is software that analyzes user activity data from logs, network traffic and endpoints and correlates this data with threat intelligence to identify activities—or behaviors—likely to indicate a malicious presence in your environment. It uses machine learning technology to baseline “normal” behavior and get smarter over time, and applies both static rules and statistical analysis to rapidly and accurately detect suspicious activity. Using such advanced technology and statistical models, UEBA is a force multiplier for security teams struggling to stay on top of today’s advanced, targeted threats.

The Case for UEBA

Featured Resource

Solution Brief

RSA NetWitness Evolved SIEM

Learn why traditional SIEM technolgy isn't enough for modern security environments, and how an evolved SIEM can accelerate threat detection and response.

Learn More



Advanced Technology

Applies statistical analysis to all data and uses modular machine learning techniques to speed threat detection and response. Identifies suspicious activity in a number of ways, by looking for specific threat indicators and by distinguishing deviations from normal network and endpoint behavior.


Rapidly Detect Anomalies

Detects unknown threats such as compromised credentials, insider threats and data exfiltration with its patented, three-tier unsupervised machine learning analytics engine. Automatically finds known and unknown threats that rule-based systems cannot with greater accuracy.


No Analyst Tuning

Reduce the need for organizations to have big data experts in their analyst team while enabling them to find unknown threats that hide among the huge volume of security data that is typical in today’s complex IT environments without heavy installation, maintenance or analyst oversight.


Machine Learning Driven UEBA

Provides fully automatic, unsupervised machine learning to facilitate the automatic identification of deviations from normal user behaviors, to uncover risky and previously hard to detect threats. By understanding behavior, RSA NetWitness UEBA can highlight potential risks such as shared user credentials, privileged user account abuse, geolocation and remote access anomalies.

icon-flexible-customizable -deployment-blue-80px

Flexible Rules

RSA NetWitness UEBA Essentials includes advanced rules and data science models that analysts can use out of the box or customize. Requires no advanced knowledge of specific attacks and does not rely on signatures, rules or analyst tuning.


icon-threat-detection and-investigation-white-80px

Provides Accurate Threat Detection

Rapidly identifies anomalies—even the slightest deviations—in user and entity behaviors to highlight potential threats with higher fidelity.


Protects Against External and Insider Threats

Shines a light on compromised credentials, abuse or misuse of privileged user accounts, insider threats, brute force and account manipulation—regardless of data source.


Makes Your SOC More Efficient

Leads to significant reductions in threat detection, investigation, response and remediation times, boosting the efficiency of your security operations center (SOC).


Alleviates Alert Fatigue

Slashes the number of incidents to investigate from the thousands to low dozens while yielding more accurate alerts, minimizing false positives and eliminating the “noise” stemming from traditional security monitoring systems.

“We selected RSA NetWitness [Platform] because we found that it absolutely leaves no stone unturned. It uses behavioral indicators to identify attacks that are normally undetected by signature and rules-based monitoring tools.”
Yumiko Matsubara
Security Architecture Manager

Recruit Technologies Co. Ltd.

RSA NetWitness UEBA is an integral part of the RSA NetWitness Platform evolved SIEM. In addition to RSA NetWitness UEBA, the RSA NetWitness Platform evolved SIEM consists of RSA NetWitness Network, RSA NetWitness Logs, RSA NetWitness Endpoint and RSA NetWitness Orchestrator. Together, these solutions deliver the industry’s most complete visibility across logs, network and endpoint data, helping to expose the full scope of attacks and make security analysts more efficient and effective through automation and advanced analytics.



3 Keys to Faster Threat Response

Threats move fast. You have to move faster. See what capabilities you need to quickly recognize the nature of a threat and implement a definitive response to it.

Learn More


5 Tools to Boost Your Security Team’s Impact

Download this short guide to find out how to equip your security team to see threats anytime, anywhere they’re hiding, to detect the full scope of attacks and respond to them faster.

Learn More

Solution Briefs

  • NetWitness Platform Solution Brief Learn how the RSA NetWitness Platform can help you address cloud security and today’s sophisticated cyber threats, all while enhancing your analysts’ efficiency and effectiveness.


  • Closing the Skills Gap Security teams need to leverage technology more than ever to close the skills gap and stay on top of attackers.


  • 11 Reasons to Love RSA NetWitness 11.x RSA NetWitness 11.x provides several significant enhancements and new functionality to address customers' needs. Take a look at eleven reasons to love RSA NetWitness 11.x.

White Papers

Want a Demo?

Sign up for a free demo today and watch our products in action.

Ready to Buy?

It's easy. Speak with an RSA expert anytime to request a quote.