Defense and intelligence · Moraph software

Insider Threat "UBA" (User Behavior Analytics)

Spot unusual activity on monitored networks, and handle it with oversight built in

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Insider Threat UBA analyzes user activity monitoring data from your networks, such as file transfers, printing, removable media and access outside normal patterns, and compares it with each user's own baseline and their peers. Anomalies come to your insider threat hub with the reasons they were flagged, and analysts work them as inquiries with legal and privacy review before any identity is revealed or referral made. The analytics propose; trained analysts and your program's senior official decide.

The problem it solves

Insider threat hubs receive large volumes of user activity monitoring data and alerts from separate tools, most of which describe ordinary work. Simple rules miss slow or unusual patterns and flag routine tasks, analysts assemble context from several systems by hand, and the program must show at every step that monitoring respected privacy, civil liberties and whistleblower protections. When an inspector asks why an inquiry was opened or who looked at a user's activity, the record is incomplete.

  • Rule-based alerts flag routine work and miss patterns that develop slowly
  • Analysts gather activity, HR and security context from separate systems
  • Identity reveal, legal review and referrals are tracked by email
  • Oversight bodies need evidence that monitoring stayed within policy

Who uses it

  • Insider threat hubs in defense and intelligence agencies
  • Cleared contractors running NISPOM insider threat programs
  • Insider threat program senior officials and hub managers
  • Legal, privacy and civil liberties officers who review program activity
  • Inspectors general and oversight staff

Requirements it supports

Executive Order 13587, Structural Reforms to Improve the Security of Classified NetworksNational Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat ProgramsCNSS Directive 504, Protecting National Security Systems from Insider ThreatDoD Directive 5205.16, The DoD Insider Threat Program32 CFR Part 117 (NISPOM), insider threat program requirements for cleared contractorsPrivacy Act of 1974 (5 U.S.C. 552a)

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    The anomaly queue

    Analysts start from a queue of anomalies under pseudonyms, each with the content that flagged it and its score.

    AnomalyUserDetectionScoreAgeStatus
    AN-90412User P-7731File transfer volume far above own baselineHigh1 dayNew
    AN-90407User P-2209Printing outside normal hours after departure noticeHigh1 dayIn review
    AN-90396User P-5180Access to repositories outside peer groupMedium2 daysIn review
    AN-90381User P-0448Removable media use on a restricted hostMedium3 daysNew
    AN-90377User P-6612Repeated failed access to restricted sharesLow4 daysClosed: approved project
    Analysts start from a queue of anomalies under pseudonyms, each with the content that flagged it and its score.

  2. Step 2

    Why it was flagged

    Each anomaly explains itself against the user's own baseline and their peers.

    User P-7731 · File transfer volume

    Detection
    Data movement against personal baseline
    Window
    Fictional sample night, 01:00 to 03:30
    Files moved
    1,240 to a local folder
    Own baseline
    Typically under 40 per day, working hours
    Peer group
    Analysts, Example Directorate (fictional)

    Contributing factors

    • Volume far above the user's 90-day baseline
    • Activity outside the user's normal hours
    • Repositories not accessed by this user before
    Each anomaly explains itself against the user's own baseline and their peers.

  3. Step 3

    Revealing an identity

    Seeing who the user is takes a written justification and an approval, both recorded.

    Reveal request · Inquiry IQ-1462 · User P-7731

    Requested by
    Analyst
    Basis
    Anomaly AN-90412 not explained by role or approved project
    Category
    Standard
    Approver
    Hub manager
    Status
    Awaiting approval

    Context requested after approval

    • Role, department and supervisor
    • Departure or transfer notices
    • Clearance and program access status
    Seeing who the user is takes a written justification and an approval, both recorded.

  4. Step 4

    The inquiry

    The inquiry keeps the evidence, the analyst's assessment and every review, so oversight can follow each step.

    Inquiry IQ-1462 · Employee 70315 (fictional)

    1. Anomaly AN-90412 escalated with justificationAnalyst
    2. Identity reveal approvedHub manager
    3. Role and departure notice added from HRAnalyst
    4. Badge records compared with activity timesAnalyst
    5. Assessment: refer to security for interviewAnalyst
    6. Legal and privacy review: concurLegal and privacy reviewer
    7. Referral approvedSenior official
    The inquiry keeps the evidence, the analyst's assessment and every review, so oversight can follow each step.

  5. Step 5

    Testing detection content

    Before a rule changes, the hub sees what it would have done to past activity, and keeps the result for oversight.

    ContentCurrent settingProposedAnomalies (current)Anomalies (proposed)Past inquiries missed
    After-hours printingOver 50 pagesOver 50 pages, excluding print-shop roles212740
    File transfer vs baseline5x baseline8x baseline168921 to review
    Removable media on restricted hostAny useNo change31310
    Before a rule changes, the hub sees what it would have done to past activity, and keeps the result for oversight.

  6. Step 6

    Oversight of hub staff

    Oversight sees what hub staff searched, viewed and revealed, and for which inquiry.

    Staff memberActionSubjectInquiryBasis
    Analyst 04Viewed activityUser P-7731IQ-1462Assigned inquiry
    Hub manager 01Approved revealUser P-7731IQ-1462Reveal request RV-3317
    Analyst 07Searched by accountUser P-3390NoneNo inquiry linked
    Analyst 04Exported referralEmployee 70315IQ-1462Approved referral
    Oversight sees what hub staff searched, viewed and revealed, and for which inquiry.

Workflows

The principal workflows

  1. Collect

    Activity data from the monitoring sources your program has authorized is brought together and normalized, with each source's coverage recorded.

    • Sources connected: user activity monitoring, file, print, removable media, authentication and access logs
    • Events normalized to a common model with the source kept on each record
    • Data quality checks flag gaps in coverage or delayed feeds
    • Retention applied per source according to your program's policy

  2. Detect

    Behavioral models and rules compare activity with the user's own history and their peer group, and produce anomalies with the factors behind them.

    • Baselines built per user and per peer group from historical activity
    • Models and rules score new activity against those baselines
    • Related events combined into a single anomaly with its contributing factors
    • Anomalies scored and placed in the hub's queue with identities pseudonymized
    • Context such as role changes or approved projects applied where your procedures allow

  3. Inquire

    Analysts review the anomaly, close it with a reason or open an inquiry. Revealing who the user is and adding personnel or security context require approval.

    • Analyst reviews the anomaly and its contributing factors
    • Anomaly closed with a reason code, or an inquiry opened with justification
    • Identity reveal requested and approved under your procedures
    • HR, security and access context added from authorized sources
    • Findings and analyst assessment recorded

  4. Refer

    Where an inquiry warrants it, a referral is prepared for counterintelligence, security, HR or law enforcement, reviewed by legal and privacy staff, and approved by the senior official.

    • Analyst prepares the referral with the supporting record
    • Legal and privacy reviewer checks it against policy and protections
    • Senior official approves or returns the referral
    • Referral delivered through the channel your procedures require and receipt recorded
    • Outcome recorded when reported back to the hub

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Insider threat analyst

Insider threat analyst, hub analyst, user activity monitoring analyst

Reviews anomalies and decides, with a recorded reason, whether each is closed or warrants an inquiry.

Sees

  • Anomalies in the queue under pseudonyms, with their contributing factors
  • Activity behind each anomaly from authorized sources
  • Identity and personnel context only after a reveal is approved
  • Their own inquiries and their status

Does

  • Reviews anomalies and closes them with a reason code and note
  • Opens inquiries with a written justification
  • Requests identity reveal and context enrichment
  • Records findings and an assessment
  • Prepares referrals with the supporting record

Cannot

  • Reveal an identity without approval
  • Approve or send a referral
  • Change detection rules, models or data sources
Approvals
Identity reveals are approved by the hub manager under policy, inquiry closures are reviewed by the hub manager, and referrals go through legal review and the senior official.
Notified about
New anomalies assigned to them, reveal requests approved or declined, and inquiries returned with comments.

Hub manager

Insider threat hub manager, hub lead, program manager

Runs the hub day to day: assigns work, reviews analysts' decisions and approves identity reveals within the policy the senior official sets.

Sees

  • All anomalies and inquiries in the hub
  • Reveal requests and their justifications
  • Workload, aging and source coverage
  • Hub staff activity in the product

Does

  • Assigns and reassigns anomalies and inquiries
  • Approves or declines identity reveal requests
  • Reviews and approves inquiry closures
  • Samples closed anomalies for quality review
  • Forwards referrals for legal review

Cannot

  • Approve a reveal for an inquiry they are working themselves
  • Approve a referral
  • Edit or delete entries in the audit trail
Approvals
Approves reveals and inquiry closures; reveals in categories your policy reserves, and all referrals, need legal review and the senior official.
Notified about
Reveal requests waiting, inquiries ready for review, aging work and source coverage gaps.

Senior official

Insider threat program senior official, designated senior official

Is accountable for the program: approves referrals, the program's monitoring policy and changes to data sources.

Sees

  • Program reporting: anomalies, inquiries, referrals and outcomes
  • Referrals awaiting approval with legal and privacy review
  • Data sources, detection content and their change history
  • The full audit trail

Does

  • Approves or returns referrals
  • Approves new data sources and changes to monitoring scope
  • Sets the identity reveal policy
  • Approves detection content going live
  • Reports on the program to agency leadership and oversight

Cannot

  • Approve a referral without the legal and privacy review recorded
  • Edit or delete entries in the audit trail
  • Remove oversight access to the audit trail
Approvals
Approves referrals, data source changes and detection content; their decisions are visible to oversight.
Notified about
Referrals waiting for approval, data source changes proposed, and program reports due.

Legal and privacy reviewer

General counsel staff, privacy officer, civil liberties officer

Checks that monitoring, identity reveals and referrals stay within law and policy, including privacy, civil liberties and whistleblower protections.

Sees

  • Reveal requests and referrals sent for their review
  • The justification and supporting record for each
  • Data sources and monitoring scope

Does

  • Reviews and concurs with or objects to referrals, with comments
  • Reviews reveal requests in categories your policy reserves
  • Reviews proposed data sources and monitoring scope changes
  • Records concerns for the senior official

Cannot

  • Open or work inquiries
  • Change detection content
  • Approve a referral on the senior official's behalf
Approvals
Their review is a required step before the senior official can approve a referral or data source change.
Notified about
Items sent for their review and decisions made on items they reviewed.

Detection engineer

Detection engineer, data scientist, analytics developer

Builds and tunes the rules and models, and documents how each works and how it was tested.

Sees

  • Detection content, its logic and change history
  • Pseudonymized activity and anomaly outcomes for testing
  • Source coverage and data quality

Does

  • Builds and changes rules and models
  • Tests content against historical data and records the results
  • Documents content logic for oversight
  • Reviews closure reasons to find noisy rules

Cannot

  • See user identities
  • Put content into production without approval
  • Open or work inquiries
Approvals
Content going live is approved by the senior official or their delegate, with the test result recorded first.
Notified about
Content tests completed, decisions on proposed content, and data quality failures.

Oversight (read-only)

Inspector general staff, oversight board member, internal auditor

Reviews the program's activity and the conduct of hub staff without being able to change anything.

Sees

  • Inquiries, reveals and referrals within the scope granted
  • Detection content documentation and changes
  • The audit trail of hub staff activity

Does

  • Searches and reads records within their scope
  • Exports records and reports, with each export logged
  • Leaves review notes where the program enables them

Cannot

  • Change, approve, close or delete anything
  • See records outside the scope and dates granted
  • Keep access after it expires
Approvals
Their access is set by the senior official or administrator with a scope and end date, and cannot be removed by hub staff during that period.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Administrator

Application administrator, systems administrator

Keeps the platform, users and data connections running, without access to anomalies or inquiries.

Sees

  • Users, roles and data source connections
  • System health and source coverage
  • The record of permission changes

Does

  • Adds and removes users, or maps them from single sign-on groups
  • Connects approved data sources and maintains feeds
  • Applies content and software updates through your change process
  • Runs access review reports

Cannot

  • See anomalies, inquiries or identities
  • Add a data source the senior official has not approved
  • Grant themselves a hub role
Approvals
Role changes and new data sources are approved by the senior official.
Notified about
Feed failures, access reviews coming due and accounts not used for a period your policy sets.

Permissions at a glance

ActionAnalystHub managerSenior officialLegal/privacyDetection eng.OversightAdmin
Review and close anomaliesOwn work onlyFullView onlyNo accessNo accessView onlyNo access
Open and work inquiriesOwn work onlyFullView onlyNo accessNo accessView onlyNo access
Reveal a user's identityNo accessApprovesApprovesView onlyNo accessView onlyNo access
Add personnel and security contextOwn work onlyFullView onlyNo accessNo accessView onlyNo access
Prepare a referralOwn work onlyFullView onlyNo accessNo accessView onlyNo access
Review a referral for law and policyNo accessNo accessView onlyFullNo accessView onlyNo access
Approve a referralNo accessNo accessApprovesNo accessNo accessView onlyNo access
Build and test detection contentNo accessView onlyView onlyNo accessFullView onlyNo access
Put detection content liveNo accessNo accessApprovesNo accessNo accessView onlyNo access
Add or change data sourcesNo accessNo accessApprovesView onlyNo accessView onlyFull
View audit trail of hub staffNo accessView onlyView onlyView onlyNo accessView onlyView only
Manage users and rolesNo accessNo accessApprovesNo accessNo accessNo accessFull
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Separation is built in: analysts work under pseudonyms until a reveal is approved, nobody approves a reveal or referral for their own inquiry, and detection engineers never see identities.
  • Legal and privacy review is a required step for referrals and data source changes, and its outcome is recorded alongside the senior official's decision.
  • Every search, view, reveal and export by hub staff is recorded in the audit trail, which oversight can read and hub staff cannot edit or hide.
  • Staff sign in through your identity provider, including CAC or PIV where your provider supports it. Roles can be limited by organization or network, and oversight gets read-only access with a defined scope and end date.

Features

What it does

Behavioral baselines

Each user's activity compared with their own history and with peers in similar roles, so unusual timing, volume or destinations stand out.

Explainable anomalies

Every anomaly shows the activity and factors that produced it, such as volume against baseline or access outside normal hours, in terms an analyst and reviewer can follow.

Pseudonymized review

Analysts work anomalies under pseudonyms; revealing a user's identity is a separate, approved and logged step.

Detection content library

Models and rules for unusual data movement, printing, removable media use, access outside normal patterns and activity after notice of departure, each documented with its logic.

Rule and model testing

Test a new or changed rule against historical data before it goes live, and keep the result as evidence for oversight.

Inquiry management

Assignment, due dates, notes, evidence and a recorded assessment for each inquiry, with supervisor review before closure.

Legal and privacy review

Built-in review steps for identity reveals, data source changes and referrals, with the reviewer's decision recorded.

Referral tracking

Referrals to counterintelligence, security, HR or law enforcement prepared, approved and tracked to an outcome.

Context enrichment

Role, department, departure notices and security records added to an inquiry from authorized sources, once its justification is approved.

Watching the watchers

Every search, view and export by hub staff is logged and available to oversight, including analysts' own activity in the product.

Source coverage monitoring

Shows which networks and sources are reporting, and flags gaps or delayed feeds that would leave activity unseen.

Disconnected deployment

Runs in an environment you operate, including networks with no outside connection, with content updates delivered through your approved transfer process.

Integrations

How it connects to your systems

Connects toHowWhat flows
User activity monitoringActivity data from the user activity monitoring tools your program already operates on its networks, loaded by file or API in your environment.In: user activity events, keyed to account identifiers.
Network and system logsAuthentication, file access, print, removable media and data transfer logs from your log management or SIEM platform.In: log events from approved sources.
Human resourcesRole, department, supervisor and departure notices, used for peer groups and added to inquiries once justified.In: personnel attributes and status changes.
Personnel securityClearance and access status from your personnel security records, including Moraph's Personnel Security Clearance Tracker, added to inquiries once justified.In: eligibility and program access status. Out: referral references where your procedures allow.
Physical accessBadge events from your access control system, so out-of-hours network activity can be compared with presence on site.In: badge events by person and facility.
Case and referral channelsReferral packages exported in a format agreed with counterintelligence, security or HR, for delivery through the channel your procedures require.Out: approved referral packages. In: receipt and outcome, recorded by hub staff.
Single sign-onHub staff sign in through your identity provider (SAML or OpenID Connect), including CAC or PIV where your provider supports it.In: user identity and group membership for role assignment.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Runs under your authority

On classified networks, the product is installed and operated in your environment under your authorizing official; Moraph does not claim accreditation for it.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Single sign-on and role-based access

Hub staff sign in through your identity provider, and pseudonymization, reveal approval and role limits control what each person sees.

Encryption under controlled keys

Data is encrypted, and in Moraph-hosted environments keys cannot be used by Moraph staff without explicit, time-bound authorization.

Complete audit trail

Every search, view, reveal, decision and export is recorded with the person and time, and cannot be edited.

AI proposes, people decide

Models flag activity for review; closing, revealing, referring and any action affecting a person are decided by trained staff.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Anomaly queue and aging

For analysts and the hub manager

Open anomalies and inquiries with their score, age, assignee and status, oldest and highest scoring first.

Break down by
Detection content, Analyst, Age band, Status
Delivered as
Live dashboard; CSV export
Used for
Balancing workload and making sure nothing sits unreviewed.

Reveal requests

For the hub manager and legal and privacy reviewers

Identity reveal requests with their justification, who requested and approved them, and the time taken.

Break down by
Status, Requester, Approver, Category
Delivered as
Live dashboard; CSV export
Used for
Keeping reveals within policy and showing each was justified.

Source coverage

For the hub manager, administrators and the senior official

Which networks and data sources are reporting, their latency, and gaps in coverage by period.

Break down by
Source, Network, Period, Status
Delivered as
Live dashboard; scheduled email
Used for
Knowing where activity is not being seen and fixing feeds.

Program management

Program summary

For the senior official and agency leadership

Anomalies reviewed, inquiries opened and closed, referrals made and outcomes reported, for the period.

Break down by
Period, Organization, Referral destination
Delivered as
PDF; scheduled email
Used for
Reporting on the program as the minimum standards and your directives require.

Referrals and outcomes

For the senior official and hub manager

Each referral with its legal review, approval, delivery and the outcome reported back.

Break down by
Destination, Status, Period
Delivered as
Live view; PDF and CSV export
Used for
Tracking referrals to an outcome and showing each was reviewed and approved.

Detection quality

Detection content performance

For detection engineers and the hub manager

Anomalies produced by each rule or model, and how many were closed, became inquiries or led to referrals.

Break down by
Content, Period, Outcome, Peer group
Delivered as
Live dashboard; CSV export
Used for
Tuning content that produces noise and keeping content that finds real concerns.

Closure reasons

For detection engineers and the hub manager

The reasons recorded when anomalies were closed, by rule or model.

Break down by
Content, Closure reason, Analyst, Period
Delivered as
Live dashboard; CSV export
Used for
Pointing tuning at the content that costs the most effort for the least value.

Content change history

For detection engineers, the senior official and oversight

Every change to a rule or model, with the test behind it and who approved it.

Break down by
Content, Change date, Approver, Change type
Delivered as
Live view; PDF and CSV export
Used for
Showing that detection content was tested, approved and documented.

Oversight

Hub staff activity

For oversight and the senior official

Searches, views, reveals and exports by each member of hub staff, with the inquiry each related to.

Break down by
User, Action, Inquiry, Date range
Delivered as
On request in the product; CSV and PDF export
Used for
Checking that hub staff used their access only for authorized purposes.

Data source and scope changes

For oversight, legal and privacy reviewers

Each data source added, changed or removed, with the legal review and approval behind it.

Break down by
Source, Change date, Approver
Delivered as
Live view; PDF export
Used for
Evidencing that monitoring scope changed only through the approved process.

Inquiry record

For oversight and the senior official

The full record of an inquiry: the anomaly, justification, reveal, context added, assessment, reviews and decisions.

Break down by
Inquiry, Action, User, Date range
Delivered as
On request in the product; PDF export
Used for
Answering oversight questions about why an inquiry was opened and how it was handled.

Exports, access and evidence

  • Every report can be exported to CSV, and summary and oversight reports to PDF. Reports can be scheduled to arrive by email within your environment for the people entitled to see them.
  • Operational and program reports show pseudonyms and counts; identities appear only where the viewer's role and an approved reveal allow.
  • Program metrics are available through the Moraph Work API in your environment, for reporting alongside other security data.
  • Reports respect each viewer's role: analysts see their own work, detection engineers see content performance without identities, and oversight sees the scope it was granted.
  • Oversight reports can be run as of a past date and give the same result each time. Running and exporting a report is itself recorded in the audit trail.

Deployment

Where and how it runs

Your environment

Installed in an environment you operate, including classified and disconnected networks, under your authorizing official. Moraph cleared staff support it only under your authority.

Moraph cloud, United States

For monitoring of unclassified networks only, hosted in the United States region with controls mapped to support your own authorization.

With a managed service

Optionally supported by a Moraph managed service for platform administration and content updates, delivered by US citizens with active clearances under your authority.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Program and policy review

We start from your insider threat policy, monitoring consent and banners, and reveal and referral procedures, and configure the product to follow them, with your legal and privacy staff involved.

Data source onboarding

Each approved source is connected and mapped in your environment, and coverage checked against the networks in scope.

Baselines and peer groups

Historical activity is used to build baselines, and peer groups are defined from HR attributes you approve.

Content tuning

Detection content is run against historical data and the results reviewed with your hub before anything is approved for production.

Workflow and roles

Queues, reason codes, reveal and referral approvals, legal review steps and roles are configured to match your procedures.

Training and go-live

Analysts, managers, reviewers and oversight staff are trained on their own tasks, and open matters from earlier tools are moved across or finished there by agreement.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • The product does not decide that anyone is a threat. Anomalies are prompts for review, and every closure, reveal and referral is decided by trained people under your procedures.
  • It analyzes the activity data your program collects. It is not a user activity monitoring agent and does not collect data from endpoints itself.
  • Detection depends on the coverage and quality of your data sources; networks or sources not connected are not seen.
  • Your organization is responsible for monitoring consent, banners, legal authority and protections for privacy, civil liberties and whistleblowers.
  • It does not take action against users or systems, such as blocking accounts or transfers.
  • It is not a counterintelligence case management or law enforcement investigation system; referrals are passed to those functions.
  • Moraph holds no accreditation for classified networks. Use there depends on your authorizing official, and operations happen under your authority.
  • Baselines need historical activity to be meaningful; new users and newly connected sources have limited history at first.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Run a sample of your own historical activity data and compare the anomalies with your current alerts
  2. Check that each anomaly's explanation would make sense to an analyst and to oversight
  3. Follow an anomaly through reveal, inquiry, legal review and referral approval
  4. Confirm what a detection engineer can and cannot see
  5. Review the hub staff activity report as your oversight body would
  6. Test a content change and review the evidence it produces

Questions

Frequently asked questions

Does the product decide who is an insider threat?

No. It flags activity that differs from a user's baseline and explains why. Trained analysts decide what to do with each anomaly, and referrals need legal review and the senior official's approval.

Can it run on our classified networks?

It can be installed in an environment you operate, including classified and disconnected networks, where your authorizing official approves it. Operations there are under your authority, and Moraph does not claim accreditation.

Does it replace our user activity monitoring tools?

No. It analyzes the data those tools and your logs already collect, and adds baselines, explanation, inquiry management and oversight.

How are privacy and civil liberties protected?

Analysts work under pseudonyms, identity reveals and referrals need approval, legal and privacy review is a required step, and every action by hub staff is visible to oversight. Your program sets and remains responsible for the policies these controls follow.

How is it priced?

As a subscription, usually measured by the number of monitored users, with implementation charged separately. See Working with Moraph for what drives a quotation.

Is there an accessibility conformance report?

Ask for one through the procurement request form at /how-to-buy/request, naming the version you are evaluating.

Next steps

Evaluate Insider Threat "UBA" (User Behavior Analytics)

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Insider Threat "UBA" (User Behavior Analytics) guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Insider Threat "UBA" (User Behavior Analytics) support guide.

Related products