XcellSecure|User & Entity Behaviour Analytics
Rules catch what you predicted. Behaviour catches what you didn't.
UEBA learns what normal looks like for every user, laptop, server and service account — then scores the moments that break the pattern. Identities stay pseudonymised until two people agree to look, and our Mumbai SOC works the alerts around the clock.
Not "is this rule broken?" but "is this normal for them?"
User and entity behaviour analytics watches how people and things actually behave — when a user signs in, from where, which files they open, how much data a laptop sends, which hosts a service account touches. It learns a baseline for each one, compares them with peers who do similar work, and raises a risk score when behaviour drifts.
That matters because the hardest attacks use real credentials. A stolen password, a misused admin account or an employee taking data on the way out breaks no signature. Rules written in advance miss them; a change in behaviour often doesn't. UEBA sits inside your SIEM, feeds its alerts into case management, and gives analysts a timeline instead of a pile of logs.
From raw sign-ins to one ranked list of people to check.
Hover or tap a stage to see what happens there. Every stage runs in your Microsoft tenant or in XcellHost's Mumbai data centre — data stays in India.
Identity, endpoint, network, cloud and HR signals
Sign-ins and directory changes from Microsoft Entra ID and Active Directory, file and mailbox activity from Microsoft 365 audit logs, process and USB events from EDR, VPN and firewall sessions, cloud and SaaS logs, and joiner–mover–leaver dates from HR. More context means fewer false alarms.
- Entra ID sign-ins & audit
- SharePoint, OneDrive, Exchange
- EDR · USB · process
Eight things UEBA does that a rule can't.
Per-entity baselines
Working hours, locations, devices, apps, data volumes and hosts touched — learned separately for each user and machine.
Dynamic peer groups
Users grouped by role, team and shared resources, so "unusual" is judged against people who do the same job.
Risk scoring with decay
Small anomalies add up; old ones fade. Analysts start at the top of a ranked list, not an alert queue.
Entity timelines
Everything one user, device or account did, in order, with the anomalous moments marked.
Non-human entities
Service accounts, servers, workloads and AI agents get baselines too — they are often the quietest way in.
First-seen & rarity
First access to a share, first use of an admin tool, a country no one in the team has signed in from.
Pseudonymised analytics
Analysts see U-3F9A, not a name. Unmasking needs two approvers and is logged.
Response hooks
High scores open a case and can trigger playbooks — step-up MFA, session revoke, device isolation — after approval.
Behaviour mapped to tactics — no made-up coverage percentages.
Each anomaly is tagged with the ATT&CK tactic and technique it most resembles, so the SOC can see which stages of an intrusion or insider incident you can observe. We show the mapping; we do not claim a coverage score.
Technique IDs checked against ATT&CK Enterprise v20 (October 2026) on attack.mitre.org, 10 November 2026. ATT&CK® is a registered trademark of The MITRE Corporation. Mapping depends on which data sources you connect.
Watch for risk, not for people.
UEBA is a security control, not a productivity tracker. We set it up so it can find a compromised account or a data theft without turning into workplace surveillance.
- Pseudonymised by default. Names, emails and device owners are replaced by stable tokens in every dashboard and alert.
- Two-person reveal. An analyst and an approver you name (HR, legal or the CISO) must agree before an identity is shown — and the reveal is logged.
- Security signals only. Sign-ins, access, data movement and admin actions. No keystrokes, screenshots, webcam or message content.
- Retention you set. Behaviour data kept for the period your policy and CERT-In's 180-day log rule need, then deleted.
- Notice & DPIA. Employee notice and a data-protection impact assessment template, aligned to the DPDP Act, 2023.
Where UEBA ends and workforce analytics begins
UEBA looks for security risk in individual behaviour and is worked by the SOC. Workforce Analytics looks at how teams work, only in aggregate. We keep the two separate: different data, different access, different purpose.
For the full insider-risk programme — HR process, DLP, privileged access and investigations — see Insider Threat.
The DPDP Act, 2023 allows processing for employment purposes, including protecting the employer from loss or liability such as corporate espionage, as a legitimate use (section 7(i)); its core duties apply from 13 May 2027. This is general information, not legal advice.
Eight synthetic users. Inject a behaviour, watch the score.
Pick a pseudonymised user, add events and advance the days. Each event's points are multiplied by how far it sits from that user's peer group; scores fade by a daily decay. All users and events are invented.
- No events yet for this entity.
Illustrative model: points = base × min(3, 1 + σ/2), where σ is the event's distance from the peer-group mean in standard deviations; score = min(100, yesterday × (1 − decay) + today's points). Real UEBA engines use their own models — the demo shows the idea, not a product's maths.
Too many alerts or too few? Move the line and see the trade-off.
600 synthetic user-days of download volume for one peer group, with 6 planted risky days. Choose how sensitive detection should be and how much the baseline knows.
—
Synthetic data generated in your browser. Short history widens the noise around each baseline; peer comparison narrows it. The 600 user-days stand for one month of a 20-person team; analyst time assumes 20 minutes per alert. Illustrative, not a benchmark.
Built into the SIEM you have, or the one we run for you.
Partner products other than Microsoft are marked *; XcellHost is a Microsoft Gold Partner.
Microsoft is moving Sentinel into the Defender portal; on Microsoft's current timeline the Azure-portal experience retires on 31 March 2027. We deploy UEBA in the Defender portal from day one.
Three ways to run it, all with data in India.
Your Microsoft tenant
Sentinel UEBA switched on in your subscription, Central India or South India region. You own the data and the licences; we run it under delegated access.
Most commonXcellHost SOC platform
Analytics hosted in our Mumbai Tier IV data centre and worked by our SOC. Suits teams without a SIEM of their own.
Fully managedYour SIEM, our analysts
Already on a partner SIEM*? We tune its UEBA content, build the peer groups and triage the output alongside your team.
Co-managedThirty days to a trusted baseline, then 24×7 eyes on it.
Data sources, licences and privacy position reviewed — start with a Sentinel readiness assessment.
01Identity, M365, endpoint and HR feeds connected; tokenisation and reveal approvers set.
02Baselines build for about 30 days* while we tune peer groups and suppress known noise.
03High scores worked by Security Operations or Managed Sentinel.
04Confirmed findings become cases with evidence; incidents follow case management and phishing response playbooks.
05Trends, tuning and risk themes for leadership — or through our vCISO.
06Start with a check, add analytics per identity.
Identities = people, service accounts and admin accounts being analysed. Microsoft licences and Azure consumption are billed separately.
Sentinel Readiness Assessment — the same engagement as on our implementation page — with the UEBA data-source and privacy checklist added*.
- Data sources & gaps
- Licence position (Entra ID, Defender)
- Pseudonymisation & reveal design
- Written plan and estimate
UEBA analytics tuned and worked by our SOC, on top of the SIEM or SOC service you choose below.
- Peer groups & baselines tuned
- Risk-ranked triage, 24×7
- Entity timelines in every case
- Two-person reveal workflow
- Monthly risk review
No SIEM yet? Managed Microsoft Sentinel Essentials (up to 10 GB/day), at the price on that page, with UEBA switched on.
- Sentinel in the Defender portal
- Indian Azure region
- CERT-In-ready log retention
- Professional & Enterprise tiers
INR, excluding 18% GST. Prices without * are the same as on Sentinel Implementation, Managed Sentinel, Security Operations and DPDP platform pages (indicative there too). * Indicative — confirm with XcellHost: the ₹99 per-identity rate, the 50-identity minimum, the ₹59,999 onboarding & privacy pack, the 30-day baseline period and the UEBA additions to the assessment.
Platform, identities, term. Total in rupees.
≈ ₹0 a month on average, excl. GST
Excl. 18% GST until the total line. * Indicative — confirm with XcellHost. Azure consumption and Microsoft licences extra.User and entity behaviour analytics learns how each user, device and account normally behaves and flags meaningful changes — an unusual time, place, volume or target. It turns many weak signals into one risk score per entity so analysts know whom to look at first.
A SIEM collects logs and runs correlation rules you define. UEBA is an analytics layer, usually inside the SIEM, that compares behaviour with baselines and peers instead of fixed rules. Next-generation SIEMs such as NG-SIEM include it.
Baselines need history. We plan for about 30 days* of learning before alerts go to the 24×7 queue; rarity and first-seen signals work sooner. Historical logs, where available, shorten this.
No. Most findings are compromised accounts — a stolen password used from a new device or country — and misused privileged or service accounts. Malicious and careless insiders are a smaller share but often the most costly.
It is security monitoring of company systems, limited to security signals, pseudonymised, with two-person reveal and a written notice to staff. It does not record keystrokes, screens, webcams or message content. Team productivity insight is a separate service, Workforce Analytics.
At minimum, identity sign-ins and directory changes (Microsoft Entra ID or AD). Microsoft 365 audit logs, endpoint telemetry and VPN/firewall sessions add depth; an HR leaver feed adds valuable context. The readiness assessment tells you what you have.
Yes. Sentinel has UEBA built in, with behaviour tables, peer analytics and investigation-priority scores. We enable and tune it, and work its output in our SOC. We also support partner SIEMs* in a co-managed model.
It can trigger playbooks — require MFA again, revoke sessions, isolate a device — but we keep a human approval step for actions that affect a named person unless you choose otherwise. False positives on people are costly.
In your Microsoft tenant in an Indian Azure region, or in XcellHost's Mumbai Tier IV data centre. CERT-In's directions ask for ICT logs to be kept for a rolling 180 days within India; we size retention for that.
Indicatively ₹99* per identity per month for managed UEBA, plus your SIEM or SOC service — for example Managed Sentinel Essentials at ₹49,999 a month or Security Operations at ₹199–₹449 per endpoint a month — all excluding 18% GST. Use the configurator above.