VbtEngine UEBA

What VbtEngine UEBA is

VbtEngine UEBA analyzes user and entity behavior to surface anomalies and insider-threat signals with risk scores. It uses existing FortiGate VPN and SSH logs, specifically fw_vpn_log and fw_ssh_log, with no new agent required. The engine builds a 30-day behavioral baseline while leaving out the most recent 24 hours. It describes twelve anomaly types, including new users or source IPs, unusual hours, volume spikes, dormant reactivation, suspected account takeover, lateral movement, and suspected brute force. Signals can be correlated, so two medium-risk findings may combine into a high-risk result. Location filtering excludes internal, VPN, loopback, link-local, multicast, and CGNAT addresses; two IPs in the same /24 are not considered different locations. Heavy log scans run in a background worker while the main API reads from a cache. Data, deduplication, and seven-day anomaly history are kept separate by tenant. Sequence correlation can open a SIEM case when a brute-force lockout is followed within an hour by specified anomalies. The technical summary specifies on-prem deployment. A demo request is available, but no price or trial terms are stated.