AI-Powered User Behavior Analytics for Insider Threats
Key Points
- AI and automation can cut the average data‑breach containment time by about 108 days, a key benefit highlighted in IBM’s 2023 Cost of a Data Breach report.
- Insider threats remain the costliest attack vector, averaging a $4.9 million loss per organization, making rapid detection and response essential.
- User‑Behavior Analytics (UBA) leverages machine‑learning to model normal user activities and flag anomalous, potentially malicious behavior, enhancing insider‑threat detection.
- Integrated into IBM Security’s SIEM (Curate), the UBA app provides dashboards that prioritize risky users, enable watch‑lists for privileged accounts, and display alerts, offenses, and risk trends.
- After a minimum learning period of about seven days, UBA can reliably identify suspicious anomalies and help analysts quickly isolate compromised or high‑risk employees.
Sections
Full Transcript
# AI-Powered User Behavior Analytics for Insider Threats **Source:** [https://www.youtube.com/watch?v=aXMPqfZt1gk](https://www.youtube.com/watch?v=aXMPqfZt1gk) **Duration:** 00:07:17 ## Summary - AI and automation can cut the average data‑breach containment time by about 108 days, a key benefit highlighted in IBM’s 2023 Cost of a Data Breach report. - Insider threats remain the costliest attack vector, averaging a $4.9 million loss per organization, making rapid detection and response essential. - User‑Behavior Analytics (UBA) leverages machine‑learning to model normal user activities and flag anomalous, potentially malicious behavior, enhancing insider‑threat detection. - Integrated into IBM Security’s SIEM (Curate), the UBA app provides dashboards that prioritize risky users, enable watch‑lists for privileged accounts, and display alerts, offenses, and risk trends. - After a minimum learning period of about seven days, UBA can reliably identify suspicious anomalies and help analysts quickly isolate compromised or high‑risk employees. ## Sections - [00:00:00](https://www.youtube.com/watch?v=aXMPqfZt1gk&t=0s) **Untitled Section** - ## Full Transcript
if you're like most Security
Professionals you're constantly looking
for ways to stay ahead of emerging
threats and improve your organization
security posture this is where AI has
the potential to make a big difference
think what it would mean if it took 108
fewer days on average to identify and
contain a data breach this faster
containment was a key finding for those
that extensively used Ai and automation
versus those that didn't according to
IBM's cost of a data breach report 2023
that was based on a survey of over 500
organizations today we're going to
explore how user Behavior analytics or
uba with AI and machine learning can
help you detect and respond to Insider
threats quickly and
precisely but before we show you how it
works let's step into the shoes of those
on a security team as you know Insider
threats are a major concern for
organizations of all sizes according to
the cost of a data breach report the
average cost of an Insider threat for an
organization was $4.9 Million us the
costliest of all reported initial attack
vectors so it's absolutely critical that
you have a solution that will help you
identify and contain these threats
faster that's where uba comes in uba
uses machine learning which is a subset
of AI that focuses on analyzing user
Behavior to identify anomalies and
potential threats when integrated with a
Sim solution uba can assist Security
Professionals and help them detect and
respond to Insider threats more
effectively now let's take a look at how
uba Works in action as part of a leading
Sim solution here we're using curate our
SIM from IBM security with its built-in
uba app to demonstrate how we can help
you quickly and easily identify and
contain Insider threats in this scenario
I'll be playing the role of a security
analyst tasked with locating Insider
threats or compromised employees I'll
use the uba app to quickly review the
numerous alerts I see every day on
employee Behavior to help effectively
identify those employees who pose a real
threat uba uses a combination of use
cases or rules and machine learning to
determine the normal daily behavior of a
user on a network and their Associated
peer group it takes a minimum of 7 days
for uba to learn user patterns and
detect suspicious
anomalies okay so let's get
started here the user Behavior analytics
dashboard provides several ways for the
analyst to understand current risks on
the left is a list of employees
prioritized by risk analysts can also
create watch lists to monitor select
groups such as highly privileged
employees in the middle the uba app
provides a view of the alerts or
offenses as they're called in Q radar
finally on the right you can see the
risks over time
and the risk category breakdown by
resource now let's look at a risky
employee in this view the analyst can
see the relevant information about an
employes behavior for example here's how
many identities the person has on the
lower left are all the offenses related
to this person the upper right panel
shows the timeline of user events
finally the lower right shows the events
grouped by session and Associated
indicators of compromise or ioc's for
each one now let's go back to the
dashboard and check out the recent
offenses that were generated based on
the information obtained from the uba
app at the top of this offenses page we
can see highlevel information related to
this potential security threat this
information includes key attributes such
as the correlated events that triggered
the anomalous activity alert along with
the source and destination IP addresses
below this information we can see the
miter attack mappings these map mapping
show the tactics and techniques
identified by Q radar during its
automated
investigation we can see more results at
the bottom where we can quickly identify
key information that's relevant to this
particular Insider Threat by integrating
AI to gain valuable insights from
structured and unstructured data into
security operations Q radar help
security analysts significantly
accelerate their investigations to take
only minutes instead of hours or days
this means sock te can shift their focus
to more proactive defense efforts
instead of struggling to react to alerts
all day so for this particular alert we
can look at the key observables
identified by Q radar during its
investigation we can see how many are
critical as well as the number of threat
actors malware families high value
assets and high value users that exist
within the current environment we can
compare the investigation results to
other investigations from a month ago we
can even see if these ioc's are found
locally or if they're just exist within
the overall environment and we can view
the trend for these ioc's over time we
can quickly see an overview of the
different miter attack tactics and
techniques that we've identified in this
particular investigation we can see the
confidence level associated with this
tactic and technique which was generated
by Q
radar Security Professionals can help Q
radar improve its analysis and future
responses by providing human feedback
that specifies whether they agree
disagree ree or uncertain about the
findings of Q radar Q radar also has
natural language insights that allow
security analysts to quickly view what
ioc's or other observed events are
identified in its
investigation in addition we can look at
related investigations that curator
identified along with the offense
summary if we want to look at the
visualized relationships within this
alert we can click on the offense
relationship graph button in this view
we can quickly visualize the key ioc for
this
alert on the left side we can toggle
which relationships we want to see
including relationships found from the
analysis of internal event and flow data
as well as the relationships that curar
uncovered using AI to conduct external
research again we can give some feedback
to provide human reinforcement learning
to Q
radar once we've completed our
investigation we can head back into the
offenses summary to quickly start
looking at other Insider threats ioc's
or or ingested correlated information
that has been conducted by Q radar in
conclusion Q radar Sim represents a
significant step forward in harnessing
Ai and automation for security
operations by streamlining processes
enhancing skills and providing
actionable insights Q radar helps
security analysts stay ahead of emerging
threats by worrying less about tedious
manual tasks and allowing them to focus
on fortifying their organization's
defenses thank you for watching if you
would like to learn more visit the Q
radar Sim webpage to view the full demo
video online or request a live
demo