Sherlocked Security – Behavioral Analytics MDR

Detecting subtle and evolving threats by profiling user, entity, and system behavior at scale.

1. Statement of Work (SOW)

Service Name: Behavioral Analytics MDR
Client Type: Enterprise, Finance, Government, Healthcare, Tech, Retail
Service Model: 24×7 Managed Detection & Response with advanced behavior-based detections
Compliance Alignment: ISO 27001, NIST CSF, MITRE D3FEND, PCI-DSS, HIPAA, SOC 2, GDPR

Scope Includes:

Behavioral baselining of users, hosts, cloud workloads, and services
Detection of anomalies based on deviation from normal patterns
UEBA (User and Entity Behavior Analytics) implementation
Insider threat and compromised account detection
Response to lateral movement, data exfiltration, privilege misuse
Model-driven detection and ML-assisted anomaly correlation
Enrichment with context from IAM, asset inventory, and threat intel

2. Our Approach

[Telemetry Ingestion] → [Behavior Baselines] → [Anomaly Detection] → [Alert Enrichment] → [Correlation & Contextual Investigation] → [Response Playbooks]

3. Methodology

Data Aggregation: Pull logs from endpoints, servers, cloud, identity providers, and SaaS
Entity Normalization: Identify and track users, devices, IPs, processes across logs
Baseline Modeling: Define "normal" using historical behavior (e.g., login patterns, data usage)
Anomaly Detection: Score deviations from norm by frequency, sequence, and peer comparison
TTP Mapping: Associate behaviors to MITRE ATT&CK tactics (e.g., Discovery, Persistence)
Alert Generation: Only high-confidence, behavior-based detections trigger response
Threat Hunting: Validate edge behaviors and suspicious clusters
Feedback Loop: Update models based on investigations and outcomes

4. Deliverables

Entity Behavior Baseline Report
Detection Use Cases (with MITRE ATT&CK mappings)
Behavioral Anomaly Alerts and Response Timeline
UEBA Playbooks and Tuning Summary
Weekly/Monthly Threat Analytics Dashboards
Incident Reports with Root Cause and Recommendations

5. Client Requirements

Consistent telemetry from endpoint, identity, SaaS, and cloud
Access to SIEM, XDR, or behavioral analytics platform
Identity provider integration (e.g., Azure AD, Okta, G Suite)
List of critical assets and high-value users (executives, IT admins)
Support for UBA tagging (privileged, contractor, guest, normal user)
Asset tagging or inventory context (function, location, business unit)

6. Tooling Stack

Platforms: Exabeam, Microsoft Sentinel UEBA, Splunk UBA, Chronicle, Sumo Logic
ML/UEBA Engines: LogScale, Azure ML, Devo, Vectra AI, Gurucul, Securonix
Data Sources: EDR/AV, IAM, VPN, AD, SaaS (Google, Microsoft 365), Proxy, DNS
Detection Models: Peer Group Analysis, Sequence Outlier, Time-Based Deviation
Enrichment: CMDB, Threat Intelligence Feeds, HR/Role metadata
Visualization: Timeline graphs, anomaly scores, peer group summaries

7. Engagement Lifecycle

Onboarding and data mapping
Entity correlation and enrichment
Model calibration (initial baselining)
Anomaly detection and tuning
Alert response and investigation
Use case expansion (new behavior signatures)
Quarterly model validation and maturity review

8. Why Sherlocked Security?

Feature	Sherlocked Advantage
Advanced Behavior Models	Detect unknown threats using statistical, ML, and sequence modeling
UEBA Maturity	Leverage both statistical anomalies and domain-specific TTPs
False Positive Reduction	Context-aware alerting avoids alert fatigue
Multi-Entity Analytics	Track and correlate users, hosts, services, cloud roles
Insider Threat Detection	Behavioral deviations from peers, past patterns, or business norms

9. Sample Use Cases

Use Case 1: Insider Data Exfiltration

Behavior: Marketing user downloads 20x usual data volume to personal cloud storage at 11 PM.
Detection: Anomaly in user’s download pattern + unsanctioned destination.
Outcome: Blocked transfer and HR escalation.

Use Case 2: Compromised Executive Credentials

Behavior: Executive logs in from foreign country, downloads confidential files, then resets MFA.
Detection: Peer-group anomaly, geo deviation, and privilege abuse correlation.
Outcome: Session terminated, investigation confirmed credential theft.

10. Behavioral Analytics MDR Readiness Checklist

Data & Telemetry

[ ] Endpoint logs (file access, process starts, user sessions)
[ ] Identity telemetry (logins, MFA, group changes, role elevation)
[ ] SaaS usage logs (Google, M365, Box, Dropbox, Salesforce)
[ ] VPN/firewall logs (source IPs, volume, session duration)
[ ] DNS/proxy logs (access to rare/unusual domains)
[ ] Network flow or session metadata
[ ] Cloud activity logs (AWS CloudTrail, Azure, GCP)
[ ] Labeling of high-risk roles, VIPs, and privileged users
[ ] Peer group definitions (by department, job function, region)
[ ] Historical baseline of at least 30 days available

UEBA Configuration

[ ] Entity correlation logic reviewed (user → host → role)
[ ] Risk scoring model approved and tested
[ ] Alert thresholds tuned per behavior type
[ ] Alert triage playbooks defined for top anomalies
[ ] False positive tuning workflow documented
[ ] Behavioral queries scripted and version-controlled

Detection Use Cases

[ ] Unusual login location or times
[ ] Data exfiltration to cloud or removable media
[ ] Lateral movement patterns not seen before
[ ] Privilege escalation outside of ticketed workflow
[ ] Sequence-based deviations (e.g., login → file deletion → process spawn)
[ ] Dormant account reactivation or privilege use
[ ] Peer-based anomalies in SaaS or email usage

Operational Readiness

[ ] Incident response team familiar with behavior-based alerts
[ ] Access to full telemetry during investigations
[ ] Ability to quarantine users/systems based on anomaly alerts
[ ] Weekly anomaly review with stakeholders
[ ] Regular UEBA model drift and detection effectiveness review
[ ] Executive summary dashboards tailored for risk trends

Continuous Improvement

[ ] Incorporate red team/emulation feedback into behavior models
[ ] Use hunt outcomes to refine normal behavior baselines
[ ] Track MITRE coverage of behavioral detections
[ ] Conduct table-top exercises with behavior anomaly injection
[ ] Periodically review top anomalies and missed detections

Behavioral Analytics MDR