R-Vision User and Entity Behavior Analytics (UEBA) by R-Vision continuously monitors security events by analyzing data from sources including Log Management systems, SIEM, and endpoints. R-Vision UEBA's analytical tools help identify signs of attacks, prioritize threats, and analyze the sequence of anomalous events. It detects anomalies that are not obvious to classic SIEM detection rules, utilizing built-in algorithms that employ statistical analysis and machine learning methods to identify anomalies and threats in event streams. R-Vision UEBA analyzes illegitimate actions related to specific objects, studying the behavior of users, accounts, and equipment, creating profiles of normal behavior, and recording any suspicious activity. It aggregates information security events from various sources, conducts a comprehensive analysis of collected events, and saves detailed information about threats and incidents in a timeline, marking anomalies. The generated alert is sent to the R-Vision SOAR system for incident response and threat prevention. R-Vision UEBA provides continuous monitoring and detection of security status changes, early warning of threats, detection of hidden and non-obvious threats, prioritization of threat criticality and anomalies, and the use of a timeline for incident analysis and event sequence recovery. Effective detection is achieved through the use of software experts who gather information from events and create behavior profiles of monitored objects to identify deviations during analysis. Additional settings enhance the accuracy of anomaly detection and consider key attack vectors. Dynamic threat and anomaly assessment calculates the danger rating of monitored objects, and changes in ratings for all objects can be tracked in real-time on dashboards.
