Insider Threat "UBA" (User Behavior Analytics)

Insider Threat UBA analyzes user activity monitoring data from your networks, such as file transfers, printing, removable media and access outside normal patterns, and compares it with each user's own baseline and their peers. Anomalies come to your insider threat hub with the reasons they were flagged, and analysts work them as inquiries with legal and privacy review before any identity is revealed or referral made. The analytics propose; trained analysts and your program's senior official decide.

The problem it solves

Insider threat hubs receive large volumes of user activity monitoring data and alerts from separate tools, most of which describe ordinary work. Simple rules miss slow or unusual patterns and flag routine tasks, analysts assemble context from several systems by hand, and the program must show at every step that monitoring respected privacy, civil liberties and whistleblower protections. When an inspector asks why an inquiry was opened or who looked at a user's activity, the record is incomplete.

Who it’s for

• Insider threat hubs in defense and intelligence agencies
• Cleared contractors running NISPOM insider threat programs
• Insider threat program senior officials and hub managers
• Legal, privacy and civil liberties officers who review program activity
• Inspectors general and oversight staff

1. CollectActivity data from the monitoring sources your program has authorized is brought together and normalized, with each source's coverage recorded.
2. DetectBehavioral models and rules compare activity with the user's own history and their peer group, and produce anomalies with the factors behind them.
3. InquireAnalysts review the anomaly, close it with a reason or open an inquiry. Revealing who the user is and adding personnel or security context require approval.
4. ReferWhere an inquiry warrants it, a referral is prepared for counterintelligence, security, HR or law enforcement, reviewed by legal and privacy staff, and approved by the senior official.

Behavioral baselines

Each user's activity compared with their own history and with peers in similar roles, so unusual timing, volume or destinations stand out.

Explainable anomalies

Every anomaly shows the activity and factors that produced it, such as volume against baseline or access outside normal hours, in terms an analyst and reviewer can follow.

Pseudonymized review

Analysts work anomalies under pseudonyms; revealing a user's identity is a separate, approved and logged step.

Detection content library

Models and rules for unusual data movement, printing, removable media use, access outside normal patterns and activity after notice of departure, each documented with its logic.

Rule and model testing

Test a new or changed rule against historical data before it goes live, and keep the result as evidence for oversight.

Inquiry management

Assignment, due dates, notes, evidence and a recorded assessment for each inquiry, with supervisor review before closure.

Legal and privacy review

Built-in review steps for identity reveals, data source changes and referrals, with the reviewer's decision recorded.

Referral tracking

Referrals to counterintelligence, security, HR or law enforcement prepared, approved and tracked to an outcome.

Context enrichment

Role, department, departure notices and security records added to an inquiry from authorized sources, once its justification is approved.

Watching the watchers

Every search, view and export by hub staff is logged and available to oversight, including analysts' own activity in the product.

Source coverage monitoring

Shows which networks and sources are reporting, and flags gaps or delayed feeds that would leave activity unseen.

Disconnected deployment

Runs in an environment you operate, including networks with no outside connection, with content updates delivered through your approved transfer process.

Insider threat analyst

Reviews anomalies, opens and works inquiries, and prepares referrals

Hub manager

Assigns work, reviews inquiry closures and approves identity reveals within policy

Senior official

Owns the program, approves referrals and the program's monitoring policy

Legal and privacy reviewer

Reviews identity reveals, referrals and data source changes against law and policy

Detection engineer

Builds, tests and documents rules and models, without access to identities

Oversight (read-only)

Views inquiries, decisions and the audit trail of hub staff, with no ability to change them

User activity monitoring

Activity data from the user activity monitoring tools your program already operates on its networks, loaded by file or API in your environment.

Network and system logs

Authentication, file access, print, removable media and data transfer logs from your log management or SIEM platform.

Human resources

Role, department, supervisor and departure notices, used for peer groups and added to inquiries once justified.

Personnel security

Clearance and access status from your personnel security records, including Moraph's Personnel Security Clearance Tracker, added to inquiries once justified.

Physical access

Badge events from your access control system, so out-of-hours network activity can be compared with presence on site.

Case and referral channels

Referral packages exported in a format agreed with counterintelligence, security or HR, for delivery through the channel your procedures require.

Single sign-on

Hub staff sign in through your identity provider (SAML or OpenID Connect), including CAC or PIV where your provider supports it.

Runs under your authority

On classified networks, the product is installed and operated in your environment under your authorizing official; Moraph does not claim accreditation for it.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Single sign-on and role-based access

Hub staff sign in through your identity provider, and pseudonymization, reveal approval and role limits control what each person sees.

Encryption under controlled keys

Data is encrypted, and in Moraph-hosted environments keys cannot be used by Moraph staff without explicit, time-bound authorization.

Complete audit trail

Every search, view, reveal, decision and export is recorded with the person and time, and cannot be edited.

AI proposes, people decide

Models flag activity for review; closing, revealing, referring and any action affecting a person are decided by trained staff.

Your environment

Installed in an environment you operate, including classified and disconnected networks, under your authorizing official. Moraph cleared staff support it only under your authority.

Moraph cloud, United States

For monitoring of unclassified networks only, hosted in the United States region with controls mapped to support your own authorization.

With a managed service

Optionally supported by a Moraph managed service for platform administration and content updates, delivered by US citizens with active clearances under your authority.

Program and policy review

We start from your insider threat policy, monitoring consent and banners, and reveal and referral procedures, and configure the product to follow them, with your legal and privacy staff involved.

Data source onboarding

Each approved source is connected and mapped in your environment, and coverage checked against the networks in scope.

Baselines and peer groups

Historical activity is used to build baselines, and peer groups are defined from HR attributes you approve.

Content tuning

Detection content is run against historical data and the results reviewed with your hub before anything is approved for production.

Workflow and roles

Queues, reason codes, reveal and referral approvals, legal review steps and roles are configured to match your procedures.

Training and go-live

Analysts, managers, reviewers and oversight staff are trained on their own tasks, and open matters from earlier tools are moved across or finished there by agreement.

• The product does not decide that anyone is a threat. Anomalies are prompts for review, and every closure, reveal and referral is decided by trained people under your procedures.
• It analyzes the activity data your program collects. It is not a user activity monitoring agent and does not collect data from endpoints itself.
• Detection depends on the coverage and quality of your data sources; networks or sources not connected are not seen.
• Your organization is responsible for monitoring consent, banners, legal authority and protections for privacy, civil liberties and whistleblowers.
• It does not take action against users or systems, such as blocking accounts or transfers.
• It is not a counterintelligence case management or law enforcement investigation system; referrals are passed to those functions.
• Moraph holds no accreditation for classified networks. Use there depends on your authorizing official, and operations happen under your authority.
• Baselines need historical activity to be meaningful; new users and newly connected sources have limited history at first.

• Run a sample of your own historical activity data and compare the anomalies with your current alerts
• Check that each anomaly's explanation would make sense to an analyst and to oversight
• Follow an anomaly through reveal, inquiry, legal review and referral approval
• Confirm what a detection engineer can and cannot see
• Review the hub staff activity report as your oversight body would
• Test a content change and review the evidence it produces