Security Vision UEBA
Security Vision UEBA analyzes activity and traffic to build behavioral models for users, accounts, devices, hosts, and processes, then identifies deviations …
What Security Vision UEBA is
Security Vision UEBA analyzes activity and traffic to build behavioral models for users, accounts, devices, hosts, and processes, then identifies deviations that may indicate suspicious behavior or incidents. Its detection combines correlation rules, statistical analysis, and machine learning. The product can analyze data from sources such as data lakes, SIEM, NGFW, proxies, and Windows or Linux devices; configured connectors also cover named network equipment, proxies, Kafka, Elasticsearch, and system logs. Users can adapt Sigma and correlation rules, and a built-in editor supports correlation-rule work. It can enrich incident data and send events or incidents to SOAR or SIEM, with response actions including changes to blocklists or active lists. The API can provide alarms, suspicious events, and object alerts. Deployment is on-premises, and the maker says machine-learning models run on customer infrastructure without sending data to the cloud. It is paid with individual pricing; license term and support level affect cost. Platforms listed are API, Linux, self-hosted, web, and Windows. The company is based in Moscow, Russia.
Good
- Combines rules, statistics, and machine learning
- Supports many event sources and connectors
- Users can adapt Sigma and correlation rules
- Enriches and forwards incidents
- API provides alarms and suspicious events
Watch out
- Paid product with individual pricing
- Final cost depends on configuration and support
- On-premises deployment
Who it suits
It suits security teams seeking behavioral analytics across users, accounts, devices, hosts, and processes, with links to SIEM or SOAR workflows. It is intended for on-premises processing.
Verdict
Security Vision UEBA combines anomaly analysis, customizable rules, and incident forwarding for on-premises security operations. Pricing varies with licensing, modules, connectors, event volume, nodes, and support.
Plans and prices
From Security Vision UEBA's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Security Vision UEBA | Priced on request | modules · connector count or events per second · optional nodes · support level · perpetual or term license · multitenancy |
The facts
Each one read from Security Vision UEBA's own pages, with the date it was checked.
What it does
- Agent model
- Deployments may be agentless or agent-based, and third-party agents can be used through connectors.checked 15 Oct 2026
- Analysis methods
- The product combines correlation rules, statistical analysis, and machine learning to identify suspicious behavior and incidents.checked 4 Oct 2026
- API
- The product API can provide alarms, suspicious events, and alerts for objects.checked 4 Oct 2026
- Automated response
- Configured actions can forward incidents to SOAR or SIEM, update SIEM active lists, block NGFW entries and block directory accounts.checked 15 Oct 2026
- Compliance claims
- The platform is listed in Russia's unified domestic-software register and the vendor states FSTEC, FSB and Ministry of Defence certifications or licenses.checked 15 Oct 2026
- Connector extensibility
- A graphical no-code builder supports new integrations and normalization of incoming data.checked 15 Oct 2026
- Custom rules
- Users can add or adapt Sigma and correlation rules, and the product includes a correlation rule editor.checked 4 Oct 2026
- Data analysis
- It analyzes raw streams from data lakes, SIEM, NGFW, proxy servers and Windows/Linux systems.checked 15 Oct 2026
- Database support
- PostgreSQL is the default free database; Jatoba and Microsoft SQL are also supported, with Elasticsearch and ClickHouse used where applicable.checked 15 Oct 2026
- Deployment architecture
- Security Vision uses client-server web applications, microservices and deployable components on separate servers or virtual machines.checked 15 Oct 2026
- Documentation availability
- The UEBA product page links downloadable presentation and product-description PDFs and a demo request.checked 15 Oct 2026
- Event sources
- It analyzes raw data from sources including data lakes, SIEM, NGFW, proxy servers, and network and Windows/Linux devices.checked 4 Oct 2026
- Incident creation
- Events are weighted and aggregated into incidents when configured counts or thresholds are exceeded, with whitelist and critical-system exceptions.checked 15 Oct 2026
- Incident response
- The product can enrich incident data and send incidents or events to SOAR or SIEM, with response actions such as adding entries to NGFW blocklists or SIEM active lists.checked 4 Oct 2026
- Independent API report
- Anti-Malware reported that the product API exposes object detections, suspicious events and alerts.checked 15 Oct 2026
- Independent documentation limit
- SecRadar says the public UEBA description is general, lacks a version and requires a technical guide to verify connectors, normalization, history and response behavior.checked 15 Oct 2026
The company
- Company background
- Security Vision describes itself as a Russian company specializing in IT systems and says its first research began in 2007.checked 4 Oct 2026
- Company legal identity
- LinkedIn identifies the maker as Security Intelligence LLC, branded Security Vision, a privately held Russian computer and network security company.checked 15 Oct 2026
- Company licensing
- LinkedIn says the company holds licenses meeting Russian FSB and FSTEC information-protection requirements and that its software is in the unified Russian programs register.checked 15 Oct 2026
- Company scale
- The official company page claims more than 600 automation projects, 40-plus Top-100 Russian customers, eight of the ten largest Russian banks and 20-plus MSSP users.checked 15 Oct 2026
- Company size
- LinkedIn lists the company size as 51–200 employees and shows 71 employees on the company page.checked 15 Oct 2026
- Company standards
- The official company page states ISO 9001 and ISO/IEC 27001 compliance and required FSB/FSTEC licenses.checked 15 Oct 2026
- Headquarters
- Moscow, Russiachecked 4 Oct 2026
Where it runs
- Correlation and machine learning
- The product combines about 30 correlation rules, roughly 50 statistical rules, machine-learning models and customer-traffic training.checked 15 Oct 2026
Alternatives to Security Vision UEBA
- 1
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 2
NetWitness Platform
WebAPILinuxmacOS6.5 - 3
Teramind Insider Risk Management
WebAPILinuxmacOS6.4 - 4
Netskope One Behavior Analytics
AndroidiOSWebAPI6.1 - 5
Veriato Insider Risk Management
AndroidAPImacOSSelf-hosted6.1 - 6
5.9