Product guide

Behavior Analytics

Detect endpoint user and process behaviour that does not match the device’s own baseline.

What Behavior Analytics Is#

Behavior analytics looks for endpoint activity that does not match what that endpoint normally does. It exists because the most damaging activity is often performed by tools that are not themselves malicious - a legitimate administration utility used by the wrong person at the wrong time.

The baseline is per endpoint. A change on a server that never changes is treated as significant, while the same change on a developer workstation may be routine.

Behavior analytics dashboard — Productivity ratio, activity duration by category, and fleet activity timeline.

Behavior Signals#

Five signal families describe most anomalous endpoint behaviour:

Signal	What it looks for
Unusual process	A process that has not been seen on this endpoint before, especially with an unexpected parent process.
Unusual parent-child chain	A process started by an application that does not normally start it, such as a document reader launching a shell.
Unusual sign-in	A sign-in at an hour, from a source, or by a user that does not match the endpoint’s normal pattern.
Unusual volume	A large number of file operations, connections, or transfers compared with the endpoint’s baseline.
Unusual persistence	A new startup item, scheduled task, or service registered outside a change window.

Combination over isolation

One unusual process is weak evidence. An unusual process, started by an unusual parent, writing a new startup item, in the same minute, is a strong signal.

Scoring and Severity#

Severity reflects how far the behaviour deviates from the endpoint’s own baseline, not from a global average.
A deviation on a server that never changes is more significant than the same deviation on a developer workstation.
Multiple weak signals on the same endpoint in a short window are raised together, because their combination is the real signal.
A score is a prompt to look, not a verdict. The platform does not label an endpoint as compromised.

Responding#

1
Confirm the baseline
Check whether the behaviour is genuinely new. A software rollout can change a process pattern for every endpoint at once.
2
Read the timeline
Open the forensic timeline for the endpoint and reconstruct the order of events around the signal.
3
Check the user
Confirm which operating system user was active. Behaviour attributed to the wrong account leads to the wrong conclusion.
4
Decide and record
Either accept the behaviour as expected and document why, or escalate it through your incident process with the timeline attached.

Do not isolate on a score alone

Isolating an endpoint disrupts a user. Confirm the behaviour against the timeline and the user before you take a disruptive action.

Frequently Asked Questions#

Is this machine learning?

The module compares observed behaviour with the endpoint’s own recorded baseline. It reports deviations and their combination; it does not produce an autonomous verdict.

Why does a new endpoint produce many signals?

A new endpoint has little baseline history, so normal behaviour looks new. Signals settle once the endpoint has been observed for a while.

Does behavior analytics replace endpoint protection?

No. It complements signature-based detection by reporting behaviour that signatures cannot describe, such as an unusual process chain with no known malicious file.

What should I do with a low-severity signal?

Read it in the context of the other signals on the same endpoint. Low-severity signals that appear together are often more meaningful than one high-severity signal alone.