Getting started with Insider Threat "UBA" (User Behavior Analytics)

Insider Threat UBA analyzes user activity monitoring data from your networks, such as file transfers, printing, removable media and access outside normal patterns, and compares it with each user's own baseline and their peers. Anomalies come to your insider threat hub with the reasons they were flagged, and analysts work them as inquiries with legal and privacy review before any identity is revealed or referral made. The analytics propose; trained analysts and your program's senior official decide.

What it is for

Insider threat hubs receive large volumes of user activity monitoring data and alerts from separate tools, most of which describe ordinary work. Simple rules miss slow or unusual patterns and flag routine tasks, analysts assemble context from several systems by hand, and the program must show at every step that monitoring respected privacy, civil liberties and whistleblower protections. When an inspector asks why an inquiry was opened or who looked at a user's activity, the record is incomplete.

• Rule-based alerts flag routine work and miss patterns that develop slowly
• Analysts gather activity, HR and security context from separate systems
• Identity reveal, legal review and referrals are tracked by email
• Oversight bodies need evidence that monitoring stayed within policy

Who uses it

• Insider threat hubs in defense and intelligence agencies
• Cleared contractors running NISPOM insider threat programs
• Insider threat program senior officials and hub managers
• Legal, privacy and civil liberties officers who review program activity
• Inspectors general and oversight staff

Before you start

• Your organization licenses Insider Threat "UBA" (User Behavior Analytics) from Moraph.
• A Moraph client account in that organization, signed in.
• Access to Insider Threat "UBA" (User Behavior Analytics) in Moraph Apps, given by an administrator in the Moraph Portal under People and access.
• For setup: the product administrator role.

Steps to get started

1. Sign in at app.moraph.com with your Moraph account.

2. Open Insider Threat "UBA" (User Behavior Analytics) from the launcher. The first time anyone opens it, its workspace is created from the default described in Workspace reference.

3. Check your role: what you can see and do depends on it. See Roles and permissions.

4. Product administrators: work through Set up Insider Threat "UBA" (User Behavior Analytics) before your team starts.

5. Everyone else: start with Everyday tasks.

Where to go next

• Set up Insider Threat "UBA" (User Behavior Analytics)
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com