Behavior analytics on-premises

While there is a big movement to the cloud, there are many companies that operate in hybrid mode, where many resources are still on-premises. In some scenarios, organizations are leaving the critical data on-premises while migrating low-risk workloads to the cloud. As covered earlier in this book, the attacker tends to silently infiltrate your network and from there, move laterally, escalate privilege, and maintain connectivity with command and control until able to execute their mission. For this reason, having behavior analytics on-premises is imperative to quickly break the attack kill chain.

According to Gartner, it is foundational to understand how users behave, and by tracking legitimate processes, organizations can enlist user and entity behavior analytics (UEBA) to spot security breaches. There are many advantages to using UEBA to detect attacks, but one of the most important ones is the capability to detect attacks in the early stages and...