Detecting account compromise with UEBA detection packages

Threat detection at Elastic ,

The Elastic InfoSec Threat Detection team is responsible for building, tuning, and maintaining the security detections used to protect all Elastic® systems. Internally, we call ourselves Customer Zero and we strive to always use the newest versions of our products. This blog details how we are building packages of detection rules that work together to create a high fidelity alert for strange user behavior.

https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt2b2800dcff7e8cac/654a75aca1a3d4040a751be1/elastic-blog-1-create-new-rule.png,elastic-blog-1-create-new-rule.png,

From within the Create new rule interface, select the type …