User Entity and Behavior Analytics (UEBA) for Security Operations (SecOps) Anomaly Identification
Description
User Entity and Behavior Analytics (UEBA) assists USCIS Security Operations (SecOps) in identifying behavioral anomalies that most likely indicate malicious intent or heightened risk associated with user identities and endpoint hosts accessing the USCIS network. The analytics provide risk scoring, which helps USCIS SecOps to prioritize highest risk incidents first.
Detailed example
Output of the Machine Learning is an alert with all artifacts for the SOC to investigate. The alert is used as a recommendation to prioritize specific investigations in the SOC ticket queue.
AI / analytics pattern
Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relationships.
Automation level / stage
c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.
Expected benefit
UEBA's purpose is to review USCIS system logs to determine when an entity is performing actions that are anomalous. An entity can be classified as a workstation, server or an internal USCIS system account. The UEBA ingests logs from systems to perform analytics based off of models that are manually created and maintained. UEBA uses the models to apply a risk score to the entity which the risk score is then used to create a case (or ticket) for Security Operations analyst review. The AI reviews the action of the analyst to adjust the risk scoring for future events. Output would assist in prioritizing cyber events for further manual investigation.
Audit / financial statement impact
This use case collates information provided by or authorized to be collected by an employee as part of network security process. The collated information supports decisions about staffing priorities but is not used to make security-related or employment-related decisions.
Controls / human review
ATO: Yes; PIA: Not published
Data needed
Data used to tune models is USCIS internal system logs.