- Home
- User and Entity Behavior Analytics Software
- VbtEngine UEBA
VbtEngine UEBA
What it is
VbtEngine UEBA analyzes user and entity behavior to identify anomalies and insider-threat signals, then assigns risk scores to findings. It uses existing FortiGate VPN and SSH logs from fw_vpn_log and fw_ssh_log, so the listed setup needs no new agent. The engine builds a behavioral baseline from 30 days of activity while leaving out the most recent 24 hours. It describes twelve anomaly types, including new users or source IPs, unusual hours, volume spikes, suspected account takeover, lateral movement, and suspected brute force. Related signals can be correlated so that two medium-risk signals together become a high-risk finding. Location filtering excludes several address categories, including internal, VPN, loopback, link-local, multicast, and CGNAT; IPs within the same /24 are not treated as different locations. Heavy scans run in a background worker while the main API reads from a cache. Data, deduplication, and seven-day anomaly history are separated by tenant. Sequence correlation can open a SIEM case after a brute-force lockout followed within an hour by specified anomalies. The technical summary specifies on-prem deployment.
For and against
For
- Uses existing FortiGate VPN and SSH logs.
- No new agent is required for the listed log sources.
- Correlates signals into elevated risk findings.
- Heavy scans run separately from the main API.
- Can automatically open specified SIEM cases.
Against
- Pricing is available on request.
- The page offers a demo request but states no trial terms.
- The technical summary specifies on-prem deployment.
The verdict
VbtEngine UEBA provides behavioral baselines, anomaly detection, and risk correlation using specified FortiGate logs. Its page does not list a price or trial terms, so prospective users need to request a demo for access details.
Who it suits
VbtEngine UEBA suits organizations using FortiGate VPN and SSH logs that want behavior-based anomaly detection and risk scoring. Its tenant separation and SIEM case automation may be relevant to multi-tenant security operations.
On the record
- Access control
- The administration module defines more than 70 atomic permissions across more than 25 domains and includes seven built-in roles.vbtengine.com · read 1 Oct 2026
- Anomaly detection
- The engine produces twelve anomaly types, including new users, new source IPs, unusual hours, volume spikes, account takeover suspicion, lateral movement and suspected brute force.vbtengine.com · read 1 Oct 2026
- Baseline
- It builds a 30-day behavioral baseline that excludes the most recent 24 hours.vbtengine.com · read 30 Sep 2026
- Behavior baseline
- It builds a 30-day behavioral baseline while excluding the last 24 hours.vbtengine.com · read 1 Oct 2026
- Company
- VBT Yazılım A.Ş. was established on 24 June 1993 to provide software, hardware and information-technology consultancy services.vbt.com.tr · read 1 Oct 2026
- Compliance
- The compliance module supports live assessment frameworks including CIS v8, ISO 27001, NIST CSF 2.0, KVKK, PCI-DSS, SOC 2 and 5651.vbtengine.com · read 1 Oct 2026
- Connectors
- The platform provides LDAP/LDAPS Active Directory synchronization plus Jira, ServiceNow, Slack, Teams, PagerDuty, Discord and generic JSON webhook integrations.vbtengine.com · read 1 Oct 2026
- Deployment
- The technical summary lists deployment as on-prem.vbtengine.com · read 1 Oct 2026
- Detection
- The engine describes twelve anomaly types, including new source IP, unusual hour, dormant reactivation, suspected account takeover, lateral movement, and suspected brute force.vbtengine.com · read 30 Sep 2026
- Log sources
- The module uses existing FortiGate VPN and SSH logs, specifically fw_vpn_log and fw_ssh_log, without a new agent.vbtengine.com · read 1 Oct 2026
- Maker
- VBT Yazılım A.Ş. says it was established on 24 June 1993 and lists an Istanbul address.vbt.com.tr · read 30 Sep 2026
- Multi-tenancy
- A single scan buckets data per tenant, with separate anomaly history and tenant-specific slices.vbtengine.com · read 1 Oct 2026
- Noise filtering
- RFC1918, CGNAT, loopback and link-local addresses are discarded as location signals, and only public routable IPs count.vbtengine.com · read 1 Oct 2026
- Performance
- Heavy scans run in an isolated background worker so the main API process is not blocked.vbtengine.com · read 1 Oct 2026
- Pricing and access
- The UEBA page offers a demo request and does not state a price or trial terms.vbtengine.com · read 30 Sep 2026
- Processing
- Heavy log scans run in a background worker, while the main API reads a cache and does not scan fw_logs.db synchronously.vbtengine.com · read 30 Sep 2026
- Purpose
- UEBA learns user and entity behavior to surface anomalies and insider-threat signals with a risk score.vbtengine.com · read 1 Oct 2026
- Risk correlation
- One medium-risk signal combined with another can escalate into a high-risk finding.vbtengine.com · read 1 Oct 2026
