Certbie
Log InSign Up
Question 1 of 30
In a corporate environment, a security analyst is tasked with implementing User and Entity Behavior Analytics (UEBA) to enhance the detection of insider threats. The analyst notices that the system flags a user for exhibiting unusual behavior, such as accessing sensitive files at odd hours and logging in from multiple geographic locations within a short time frame. To effectively assess whether this behavior is indeed malicious or benign, which of the following approaches should the analyst prioritize to refine the UEBA model and reduce false positives?
Incorporating contextual data such as the user's role, department, and historical access patterns to establish a baseline of normal behavior.
Increasing the sensitivity of the anomaly detection algorithms to capture more potential threats, regardless of the context.
Limiting the analysis to only high-risk users based on their previous security incidents, ignoring the broader user base.
Implementing a strict threshold for alerts that only triggers notifications for the most extreme deviations from average behavior.