Insider Threat "UBA" (User Behavior Analytics)

Principal workflows

• Collect: Activity data from the monitoring sources your program has authorized is brought together and normalized, with each source's coverage recorded.
• Detect: Behavioral models and rules compare activity with the user's own history and their peer group, and produce anomalies with the factors behind them.
• Inquire: Analysts review the anomaly, close it with a reason or open an inquiry. Revealing who the user is and adding personnel or security context require approval.
• Refer: Where an inquiry warrants it, a referral is prepared for counterintelligence, security, HR or law enforcement, reviewed by legal and privacy staff, and approved by the senior official.

Who uses it

• Insider threat hubs in defense and intelligence agencies
• Cleared contractors running NISPOM insider threat programs
• Insider threat program senior officials and hub managers
• Legal, privacy and civil liberties officers who review program activity
• Inspectors general and oversight staff

Reporting

• Anomalies and inquiries by age and analyst
• Identity reveal requests and approvals
• Data source coverage and gaps
• Referrals and reported outcomes
• Detection content performance and changes
• Hub staff activity for oversight

Features

• Behavioral baselines: Each user's activity compared with their own history and with peers in similar roles, so unusual timing, volume or destinations stand out.
• Explainable anomalies: Every anomaly shows the activity and factors that produced it, such as volume against baseline or access outside normal hours, in terms an analyst and reviewer can follow.
• Pseudonymized review: Analysts work anomalies under pseudonyms; revealing a user's identity is a separate, approved and logged step.
• Detection content library: Models and rules for unusual data movement, printing, removable media use, access outside normal patterns and activity after notice of departure, each documented with its logic.
• Rule and model testing: Test a new or changed rule against historical data before it goes live, and keep the result as evidence for oversight.
• Inquiry management: Assignment, due dates, notes, evidence and a recorded assessment for each inquiry, with supervisor review before closure.
• Legal and privacy review: Built-in review steps for identity reveals, data source changes and referrals, with the reviewer's decision recorded.
• Referral tracking: Referrals to counterintelligence, security, HR or law enforcement prepared, approved and tracked to an outcome.
• Context enrichment: Role, department, departure notices and security records added to an inquiry from authorized sources, once its justification is approved.
• Watching the watchers: Every search, view and export by hub staff is logged and available to oversight, including analysts' own activity in the product.
• Source coverage monitoring: Shows which networks and sources are reporting, and flags gaps or delayed feeds that would leave activity unseen.
• Disconnected deployment: Runs in an environment you operate, including networks with no outside connection, with content updates delivered through your approved transfer process.

Integrations

• User activity monitoring: Activity data from the user activity monitoring tools your program already operates on its networks, loaded by file or API in your environment.
• Network and system logs: Authentication, file access, print, removable media and data transfer logs from your log management or SIEM platform.
• Human resources: Role, department, supervisor and departure notices, used for peer groups and added to inquiries once justified.
• Personnel security: Clearance and access status from your personnel security records, including Moraph's Personnel Security Clearance Tracker, added to inquiries once justified.
• Physical access: Badge events from your access control system, so out-of-hours network activity can be compared with presence on site.
• Case and referral channels: Referral packages exported in a format agreed with counterintelligence, security or HR, for delivery through the channel your procedures require.
• Single sign-on: Hub staff sign in through your identity provider (SAML or OpenID Connect), including CAC or PIV where your provider supports it.

Deployment

• Your environment: Installed in an environment you operate, including classified and disconnected networks, under your authorizing official. Moraph cleared staff support it only under your authority.
• Moraph cloud, United States: For monitoring of unclassified networks only, hosted in the United States region with controls mapped to support your own authorization.
• With a managed service: Optionally supported by a Moraph managed service for platform administration and content updates, delivered by US citizens with active clearances under your authority.

Security and privacy

• Runs under your authority: On classified networks, the product is installed and operated in your environment under your authorizing official; Moraph does not claim accreditation for it.
• Cleared support lane: Support tickets from federal and defense clients are handled only by US citizens with active security clearances.
• Single sign-on and role-based access: Hub staff sign in through your identity provider, and pseudonymization, reveal approval and role limits control what each person sees.
• Encryption under controlled keys: Data is encrypted, and in Moraph-hosted environments keys cannot be used by Moraph staff without explicit, time-bound authorization.
• Complete audit trail: Every search, view, reveal, decision and export is recorded with the person and time, and cannot be edited.
• AI proposes, people decide: Models flag activity for review; closing, revealing, referring and any action affecting a person are decided by trained staff.

Limitations

• The product does not decide that anyone is a threat. Anomalies are prompts for review, and every closure, reveal and referral is decided by trained people under your procedures.
• It analyzes the activity data your program collects. It is not a user activity monitoring agent and does not collect data from endpoints itself.
• Detection depends on the coverage and quality of your data sources; networks or sources not connected are not seen.
• Your organization is responsible for monitoring consent, banners, legal authority and protections for privacy, civil liberties and whistleblowers.
• It does not take action against users or systems, such as blocking accounts or transfers.
• It is not a counterintelligence case management or law enforcement investigation system; referrals are passed to those functions.
• Moraph holds no accreditation for classified networks. Use there depends on your authorizing official, and operations happen under your authority.
• Baselines need historical activity to be meaningful; new users and newly connected sources have limited history at first.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/insider-threat-uba-user-behavior-analytics. Purchasing routes and company information: www.moraph.com/how-to-buy.