Entity-Based Detection Rules

EBA: Web Device Using Lateral Movement Protocols on events, which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Multiple Hosts Communicating with Suspicious External IP on events which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Rare External Destination Access by Server on events which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Potential Port Scanning Behavior Detected on events which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Excessive Connection Attempts to High Risky Remote Access Ports on events which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Host Infection Pattern on events which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Potential Host Lateral Movement Detected on events which are detected by the Local system
The QRadar User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.

Parent topic: Rules and tuning for the UEBA app