Analytics

User Behaviour AnalyticsNew

Analyses user activity across your environment to detect anomalous behaviour — unusual login patterns, data exfiltration signals, privilege abuse, and lateral movement — before it becomes an incident.

Get a Demo Login to App

User Behaviour Analytics

Detect insider threats and account compromise early

What it does

Key capabilities

Risk-Scored Users

Every user in your environment is scored by anomaly frequency, severity, and behaviour pattern — surface your highest-risk accounts at a glance.

Anomaly Timeline

Chronological anomaly feed with event type, severity, source, and timestamp — drill down to the raw event for investigation.

Alert Categories

Detects login anomalies, impossible travel, off-hours access, bulk data downloads, unusual privilege use, and lateral movement indicators.

Trend Analysis

Week-over-week and month-over-month anomaly trends highlight whether your insider threat posture is improving or deteriorating.

UBA Report

Export a PDF report with executive summary, top-risk users, anomaly breakdown by category, and trend analysis for the selected period.

Multi-Source Data

Aggregates data from HakObserver agents, Microsoft 365 sign-in logs, VPN sessions, and security detections for a holistic user risk picture.

Highlights

Why User Behaviour Analytics?

  • Scores every user in your environment by risk level
  • Detects 6+ anomaly categories including impossible travel
  • Aggregates HakObserver, M365, VPN, and detection data
  • Week-over-week trend analysis for board reporting
  • PDF report ready for compliance and audit teams
Request Demo Talk to us
Included in OneView

User Behaviour Analytics is part of the Hakware OneView platform. All findings, events, and data from this module flow into your central dashboard alongside every other security signal in your environment.

24/7 Support Available
Phone: +27 060 984 1210
FAQs

Frequently asked questions

Each user's risk score is derived from: HakObserver agent telemetry (process anomalies, off-hours logins), Microsoft 365 sign-in risk detections (impossible travel, unfamiliar location), VPN session data (unusual connection times or locations), Microsoft Defender detections associated with the user, and UBA-specific anomaly algorithms applied across all these sources together.

UBA detects six primary anomaly categories: login anomalies (unusual times, failure patterns, location changes), impossible travel (two sign-ins from geographically impossible locations within a short window), off-hours access (activity significantly outside the user's established baseline hours), bulk data downloads, unusual privilege use, and lateral movement indicators across hosts.

Compromised accounts typically exhibit behavioural changes that differ from the account owner's baseline — logins at unusual times, access to systems not previously visited, data access volumes above normal. UBA establishes per-user behavioural baselines and fires alerts when deviations exceed statistical thresholds, catching account takeover before significant damage occurs.

Yes. UBA's report function generates a PDF covering the selected time period — an executive summary, the top-risk users with their anomaly breakdown, a category-level analysis of detected anomaly types, and week-over-week trend charts. The report is suitable for CISO briefings, board risk committee presentations, and insider threat programme reviews.

Related modules

Threat AnalyticsNew

Behavioural threat intelligence dashboards

Learn more

Event ManagementNew

Centralised security event correlation

Learn more

MITRE ATT&CKNew

Live threat coverage matrix powered by your security stack

Learn more

See User Behaviour Analytics in action

Request a personalised demo and we'll show you exactly how User Behaviour Analytics works within your environment.

Request Free Demo All Modules