risk-aligned use cases
0
UEBA rules for anomalies
0
+
threat feeds on IoCs
0
behavior models
0
+
LEVERAGE MACHINE LEARNING AND AI
Detect undetectable insider behavior with AI
Intentional or not, insider threats are some of the greatest risks to organizations. Whether it’s credential misuse, accessing sensitive data, or destroying proprietary information, Exabeam UEBA capabilities help you detect and respond to risky behavior patterns.
IDENTIFY ABNORMAL CREDENTIAL USAGE
You can’t fight what you can’t see
Exabeam stands out by detecting invalid use of credentials. Industry-leading behavioral detections score insider activity based on risk, revealing anomalies. Most SIEMs can’t provide this, and EDR tools lack the context.
UNCOVER AUDIT TAMPERING
Identify and isolate log tampering
An insider with knowledge of auditing and event logging can tamper or clear logs to avoid detection. Exabeam enriches abnormal activity with user and business context data, so analysts can determine if an insider is tampering and acting with malicious intent.
DELETION AND DESTRUCTION OF DATA
Monitor user activity, flag abnormalities
A malicious insider may intentionally destroy critical business information in order to disrupt operations or cause financial harm. Exabeam baselines user activity and flags abnormalities in the number of files deleted to help detect malicious insiders motivated to wreak havoc on an organization.
DETECT MALICIOUS INSIDERS
Spotting credential misuse for personal gain
Malicious insiders pose a significant risk due to their access and knowledge of secrets, vulnerable IPs, and critical systems. Organizations need comprehensive monitoring and instant incident scope measurements for rapid risk communication.
DISCOVER DATA LEAKAGE
Understand user intent quickly and accurately
Data leaks can closely resemble normal activity, making them challenging to detect. The Exabeam platform combines DLP alerts with authentication, access, and contextual data sources viewable in a user activity timeline – a complete picture of a user’s activity.
- Determine the intent of user activity
- Analyze initial or failed host access against historical behavior
MONITOR PRIVILEGED USERS
Identify unauthorized access, prevent breaches
Attackers exploit privileged accounts to evade security measures, disrupt operations, or exfiltrate sensitive data. Exabeam detects and prevents unauthorized privileged activity by analyzing user context and identifying abnormal behavior patterns.
DETECT PRIVILEGE ESCALATION
Monitor credential use, identify anomalies
Privilege escalation grants unrestricted access to critical assets. Exabeam combats this by detecting techniques like credential enumeration and bloodhound execution, thwarting attackers’ privilege escalation attempts.
MONITOR FOR DATA ACCESS ABUSE
Identify and isolate high-risk access to sensitive corporate data
Malicious insiders abuse their privilege to access sensitive corporate data. Flagging anomalous activity helps security teams detect a malicious insider abusing data access, preventing them from causing greater harm to their organization.
- Establish what normal access activity looks like
- Analyze access against historical behavior
PHYSICAL ACCESS SECURITY
Monitor building access and geolocation
Exabeam detects changes in behavior, like badges into a building or when a user travels between locations at an impossible speed. These incidents could show an employee who has shared their badge or a malicious insider attempting to access and destroy physical assets.
How can we help? Talk to an Expert.
Frequently Asked Questions
How does Exabeam cover insider threats?
Exabeam covers insider threats through two main categories:
- Malicious Insiders: Abnormal Authentication and Access, Data Leak, Privilege Abuse, Destruction of Data, Data Access, Workforce Protection, Audit Tampering, Physical Security
- Compromised Insiders: Data Exfiltration, Privileged Activity, Compromised Credentials, Lateral Movement, Account Manipulation, Evasion, Privilege Escalation, Cloud Data Protection
These indicators are monitored through rule coverage within Outcomes Navigator, included with the platform. To comprehensively monitor insider threats, sourcing for each category is advised. Exabeam provides pre-deployment workshops and online documentation detailing the content and sources for each. Essential logs include event login/ authentication, server/asset access, and data exfiltration indicators.
Does Exabeam map Lateral Movement to the MITRE ATT&CK® framework?
Yes. The Lateral Movement tactic includes the Remote Services technique, which in turn encompasses sub-techniques such as Remote Desktop Protocol (RDP), SMB/Windows Admin Shares, Distributed Component Object Model (DCOM), Secure Shell (SSH), Virtual Network Computing (VNC), and Windows Remote Management (WinRM). These services can each be exploited in different ways. Exabeam detects lateral movement and insider threats with UEBA, lets you build correlation rules to alert and build cases, automates responses through Automation Management, and offers pre-built dashboards sorted by ATT&CK TTPs.
Can I keep my current SIEM and use Exabeam as augmentation?
Absolutely. Many customers integrate data feeds from various SIEMs like Splunk, Microsoft Sentinel, IBM Qradar, OpenText ArcSight, McAfee Nitro, Sumo Logic, and Google Cloud Pub/Sub. Exabeam offers fast integration and value, enhancing your existing SIEM with UEBA and efficient workflows, without the need for extensive team re-training.
What common SIEMs can Exabeam augment with AI-driven threat detection, investigation, and response?
Exabeam has pre-built collectors for several common SIEM platforms, including Splunk Enterprise Security, IBM Qradar, Microsoft Sentinel, XDR, and Sentinel. Additional supported vendors include Palo Alto Networks, Fortinet, CrowdStrike, and others, detailed here.
“In 90% of real attacks, we see compromised credentials used, which can be very hard to detect and defend. We chose Exabeam because their tools can successfully detect these kinds of attacks as they use many sources, not just security alerts. Their technology effectively analyzes and baselines normal usage to quickly alert on a compromised user or credentials.”
