- Home
- User and Entity Behavior Analytics Software
- Security Vision UEBA
Security Vision UEBA
Moscow, Russia
What it is
Security Vision UEBA builds behavioral models for users, accounts, devices, hosts, and processes, then looks for deviations in activity and traffic that could indicate suspicious behavior or incidents. It combines correlation rules, statistical analysis, and machine learning. The product analyzes raw data from sources such as data lakes, SIEM, NGFW, proxy servers, and Windows or Linux devices. Configured connectors cover SIEM systems, named network equipment and proxies, Kafka, Elasticsearch, and Windows and Linux logs. Users can add or adapt Sigma and correlation rules, and a correlation-rule editor is included. For incident response, UEBA can enrich incident data and send incidents or events to SOAR or SIEM; actions can include adding entries to NGFW blocklists or SIEM active lists. Its API can provide alarms, suspicious events, and object alerts. Deployment is on premises, and the maker says machine-learning models run on customer infrastructure without sending data to the cloud. Pricing is individual and depends on factors including modules, connectors or event volume, additional nodes, support, license type, and multi-tenancy. Licenses may be perpetual or time-limited.
For and against
For
- Combines rules, statistical analysis, and machine learning.
- Supports adaptable Sigma and correlation rules.
- Can enrich and route incidents to SOAR or SIEM.
- Machine-learning models run on customer infrastructure.
Against
- Pricing is individual and available on request.
- License term and support level affect the final cost.
- Deployment is on premises.
The verdict
Security Vision UEBA combines behavioral analysis with configurable rules and incident-response handoffs. Its individual pricing and on-premises deployment make cost and infrastructure requirements important factors to evaluate.
Who it suits
Security Vision UEBA suits security and IT teams that analyze behavior across users, devices, hosts, and processes. It may also suit organizations that need on-premises processing and incident handoffs to SOAR or SIEM.
Plans and prices
Security Vision UEBA
modules · connector count or events per second · optional nodes · support level
Read 15 Oct 2026 · securityvision.ru
On the record
- Agent model
- Deployments may be agentless or agent-based, and third-party agents can be used through connectors.securityvision.ru · read 15 Oct 2026
- Analysis methods
- The product combines correlation rules, statistical analysis, and machine learning to identify suspicious behavior and incidents.securityvision.ru · read 4 Oct 2026
- API
- The product API can provide alarms, suspicious events, and alerts for objects.securityvision.ru · read 4 Oct 2026
- Automated response
- Configured actions can forward incidents to SOAR or SIEM, update SIEM active lists, block NGFW entries and block directory accounts.securityvision.ru · read 15 Oct 2026
- Company background
- Security Vision describes itself as a Russian company specializing in IT systems and says its first research began in 2007.securityvision.ru · read 4 Oct 2026
- Company legal identity
- LinkedIn identifies the maker as Security Intelligence LLC, branded Security Vision, a privately held Russian computer and network security company.linkedin.com · read 15 Oct 2026
- Company licensing
- LinkedIn says the company holds licenses meeting Russian FSB and FSTEC information-protection requirements and that its software is in the unified Russian programs register.linkedin.com · read 15 Oct 2026
- Company scale
- The official company page claims more than 600 automation projects, 40-plus Top-100 Russian customers, eight of the ten largest Russian banks and 20-plus MSSP users.securityvision.ru · read 15 Oct 2026
- Company size
- LinkedIn lists the company size as 51–200 employees and shows 71 employees on the company page.linkedin.com · read 15 Oct 2026
- Company standards
- The official company page states ISO 9001 and ISO/IEC 27001 compliance and required FSB/FSTEC licenses.securityvision.ru · read 15 Oct 2026
- Compliance claims
- The platform is listed in Russia's unified domestic-software register and the vendor states FSTEC, FSB and Ministry of Defence certifications or licenses.securityvision.ru · read 15 Oct 2026
- Connector extensibility
- A graphical no-code builder supports new integrations and normalization of incoming data.securityvision.ru · read 15 Oct 2026
- Correlation and machine learning
- The product combines about 30 correlation rules, roughly 50 statistical rules, machine-learning models and customer-traffic training.securityvision.ru · read 15 Oct 2026
- Custom rules
- Users can add or adapt Sigma and correlation rules, and the product includes a correlation rule editor.securityvision.ru · read 4 Oct 2026
- Data analysis
- It analyzes raw streams from data lakes, SIEM, NGFW, proxy servers and Windows/Linux systems.securityvision.ru · read 15 Oct 2026
- Database support
- PostgreSQL is the default free database; Jatoba and Microsoft SQL are also supported, with Elasticsearch and ClickHouse used where applicable.securityvision.ru · read 15 Oct 2026
- Deployment architecture
- Security Vision uses client-server web applications, microservices and deployable components on separate servers or virtual machines.securityvision.ru · read 15 Oct 2026
- Documentation availability
- The UEBA product page links downloadable presentation and product-description PDFs and a demo request.securityvision.ru · read 15 Oct 2026
