Reference
Insider Threat "UBA" (User Behavior Analytics) glossary
Terms used in Insider Threat "UBA" (User Behavior Analytics) and its documentation.
Applies to Insider Threat "UBA" (User Behavior Analytics) as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.
Terms used in Insider Threat "UBA" (User Behavior Analytics) and its documentation.
| Term | Meaning |
|---|---|
| Anomaly | Activity that differs from a user's own baseline or their peers', produced by detection content for review. |
| Baseline | A user's or peer group's normal pattern of activity, built from historical data. |
| Peer group | Users in similar roles whose activity is compared with each other. |
| Pseudonym | The identifier analysts see in place of a user's real identity. |
| Identity reveal | An approved, logged step that shows an analyst who a pseudonymized user is. |
| Inquiry | An analyst's structured review of one or more anomalies. |
| Referral | A package sent to counterintelligence, security, HR or law enforcement after legal review and senior official approval. |
| Detection content | The models and rules that score activity and produce anomalies. |
| Senior official | The person who owns the insider threat program and approves referrals and the monitoring policy. |
| Source coverage | Which networks and data sources are reporting, and where gaps leave activity unseen. |
Was this page helpful?
Report a problem with this page
Need help with your own setup rather than this page? Raise a support ticket.