UEBA Based on Log
In earlier releases, User Entity Behavior Analytics (UEBA) was done based on proprietary logs collected by the FortiSIEM Windows UEBA Agent. Now, the analytics is extended to the following regular logs. Note that regular logs only cover a subset of the user activities compared to the FortiSIEM UEBA Agent.
Windows Security logs
- Unusual machine on activity based on Win-Security-4608 log
- Unusual machine off activity based on Win-Security-4609 log
- Unusual host logon activity based on Win-Security-4624 log
- Unusual host logoff activity based on Win-Security-4634 log
- Unusual file deletion based on Win-Security-4660 log
- Unusual process created based on Win-Security-4688 log
- Unusual process stopped based on Win-Security-4689 log
Windows Sysmon
- Unusual process created based on Win-Sysmon-1-Create-Process log
- Unusual process stopped based on Win-Sysmon-5-Process-Terminated log
- Unusual file creation based on Win-Sysmon-11-FileCreate log
- Unusual file deletion based on Win-Sysmon-23-File-Delete-archived and Win-Sysmon-26-File-Delete-logged log
Linux Agent
- Unusual process created based on LINUX_PROCESS_EXEC log
- Unusual machine off activity based on Generic_Unix_System_Shutdown log
- Unusual host logon activity based on Generic_Unix_Successful_SSH_Login log
For detailed comparison of Windows UEBA Agent versus log based UEBA, see Appendix - Comparing UEBA Sources.