UEBA and MonitorDog: Extending Insider Anomaly Detection to Screen Security

Security incidents do not always begin with an external attacker breaking through a firewall. A departing employee viewing customer records, a contractor account logging in at an unusual time, or an authorized user photographing a sensitive screen with a smartphone can all become very real threats.

This is where UEBA (User and Entity Behavior Analytics) often comes into the conversation. In simple terms, UEBA is about moving beyond the question, "Does this user have permission?" and also asking, "Is this behavior different from what is normal?"

3-Minute Summary

• UEBA is a security approach that detects anomalies based on the normal behavior patterns of users, accounts, devices, and applications.
• Insider threats often use legitimate privileges, so login success and access rights alone are not enough to judge risk.
• MonitorDog records behavior in front of work screens, such as screen filming attempts, absence from the seat, multiple-person detection, and screenshot attempts, as events and connects them to scenario-based suspicious activities, extending UEBA visibility into screen security.

---

UEBA in One Sentence

UEBA is an analytics approach that learns normal behavior for users and system entities, then treats meaningful deviations from that baseline as risk signals.

"User" includes employees, administrators, contractors, partners, and other human-operated accounts. "Entity" expands the scope to PCs, servers, applications, service accounts, storage devices, IP addresses, and other objects that can generate security events.

Traditional security often works with predefined rules: alert when a blocked program runs, record when a USB storage device connects, or block a user who tries to access an admin page without permission. These rules are still necessary. But insider threats and account takeover attacks are often hard to catch with rules alone.

The problem is that the user may actually have valid permissions. UEBA therefore adds questions such as:

• Is this user viewing far more sensitive screens than usual?
• Are the same events repeating in a short period of time?
• Is the activity happening from an unusual location, device, or time of day?
• Does a combination of several signals raise the overall risk?

In other words, UEBA is less about a single event and more about the context of behavior.

Why Insider Threats Need UEBA

Insider threats are difficult because the attacker can look "normal."

External attackers may leave clearer traces, such as malware, vulnerability exploitation, or abnormal network connections. Insiders, on the other hand, log in with work accounts, use approved applications, and access data they are allowed to reach. Even when an account has been compromised, the activity can still appear to come from a legitimate user.

Consider these situations:

• A customer service representative repeatedly views far more customer detail screens than usual.
• A specific employee's PC generates multiple screenshot attempts in a short time.
• During remote work, absence events and facial authentication failures occur repeatedly.
• Smartphone use events are detected repeatedly while a sensitive work screen is open.
• A user connects from an unusual IP or device and then runs a capture program.

Each event by itself may look harmless. But when time, user, device, and business context are viewed together, the story changes. This is where UEBA becomes useful.

Common Signals UEBA Looks At

The data used by UEBA differs by organization, but the basic signals are usually similar.

1. Login and Access Patterns

Login time, location, IP address, device, and authentication success or failure counts are basic analysis targets. If an account that normally works from the Seoul office logs in from an overseas IP at dawn, or if authentication fails many times in a short period, it deserves attention.

2. Data Access and Usage Volume

Unusually high customer record views, large downloads, repeated searches, and increased access to sensitive systems are important signals. Insider incidents often progress through many small actions rather than one dramatic event.

3. Endpoint and Application Behavior

Blocked program execution, capture program use, external storage connections, and abnormal process execution are important behavior data from the user's work environment. These signals matter on their own, but they become more accurate when combined with a user-specific baseline.

4. Physical and Visual Behavior

One area often missed in UEBA discussions is behavior in front of the screen. A user does not need to download sensitive data as a file. If they open it on the screen and photograph it with a smartphone, the information may already have left the organization.

Screen filming attempts, multiple-person detection, absence from the seat, screen unlock failures, and screenshot attempts can all become useful supporting signals for insider anomaly detection. The last point where data is actually exposed is often the screen.

How Is UEBA Different From Rule-Based Detection?

Rule-based detection asks, "Did a predefined condition occur?" For example, if a smartphone detection event occurs three times within one minute, it can be classified as suspicious activity.

UEBA goes one step further. It does not only check whether a condition was met. It also asks whether the behavior is unusual for this specific user, what sequence of events came before it, and how far it deviates from the normal pattern of the user's department or role.

In practice, both approaches are usually used together.

• Clearly risky behavior is blocked quickly with rules.
• Ambiguous but repeated behavior is accumulated and analyzed from a UEBA perspective.
• Several low-risk signals can be combined and escalated into suspicious activity.
• Administrators review the context, add comments, and adjust policies based on actual risk.

The goal of security operations is not to label every anomaly as an incident. It is to avoid missing signals that deserve review and prioritize response.

How MonitorDog Connects to UEBA

MonitorDog does not replace a traditional UEBA platform. Instead, it brings user behavior in front of the screen, an area that UEBA often struggles to observe, into security events.

The MonitorDog agent records various actions that occur on a user's PC as events. These can include smartphone use, multiple-person detection, absence detection, login and logout, webcam on and off, meeting mode changes, screenshots, facial authentication success and failure, and system shortcuts.

These events do not stop at simple logging. Administrators can create scenarios in the admin console and classify activity as suspicious activity when certain events occur too frequently in a short period, exceed an allowed range, or do not match normal user patterns.

For example:

• If smartphone use events occur multiple times within one minute, register them as a high-risk suspicious activity.
• If facial authentication failures repeat after an absence event, respond with a lock that requires administrator approval or password re-authentication.
• If screenshot attempts and blocked program execution repeatedly occur for the same user, register them as high-risk suspicious activity.

This turns a single event such as "a smartphone appeared once" into a contextual judgment based on who did what, when, on which device, in what sequence, and how repeatedly.

Why Screen Security Matters in UEBA

Most security logs record what happens inside the system: whether a file was opened, sent over the network, copied to USB, or which process was executed.

But photographing a monitor with a smartphone is not an internal system event. It does not call the operating system's screenshot API, pass through the network, or leave a file trace on the company PC. The user's personal smartphone camera simply saves the screen as an image.

That is why screen security expands UEBA visibility. To handle insider threats realistically, organizations need to ask not only "What did the account do?" but also "What did the user do in front of the screen when the information was visible?"

MonitorDog uses webcam-based AI models to detect events such as smartphone use near the screen and multiple people in front of the display. When necessary, it can connect those events to screen locking or administrator approval workflows. Screen and webcam images from the moment of an event are private by default, and when administrators need to review them, they can do so through a limited security audit process.

This balance matters. Insider threat management requires records, but the records themselves should not become another privacy risk.

Questions to Ask Before Introducing UEBA

Before adopting UEBA or improving an insider anomaly detection program, start with these questions:

• Where are sensitive screens most frequently displayed in our organization?
• Do we have a baseline for distinguishing normal work from anomalous behavior?
• Can we analyze combinations of events rather than isolated events?
• When suspicious activity occurs, who reviews it and by what criteria?
• Can we observe physical behavior outside the system, such as screen filming, absence from the seat, and multiple-person detection?
• When event images or logs are reviewed, are permissions, reasons, time limits, and history recorded?

The purpose of UEBA is not to create a culture of suspicion. It is the opposite. UEBA should replace vague surveillance with clear policies and records that help distinguish real risk signals.

Practical Principles for Implementation

First, do not try to block everything automatically from the beginning. Normal behavior differs by workplace, so it is often better to start by recording events, reviewing them, and tuning criteria for the organization.

Second, separate risk levels. If every event is treated as high risk, the security team will quickly suffer from alert fatigue. Risk should be classified as low, medium, or high based on repetition, sensitive data access, time of day, user role, and physical exposure risk.

Third, define response procedures in advance. Some suspicious activities only require review, while others may require immediate screen locking or administrator approval. MonitorDog scenarios can distinguish between no lock, user self-unlock, and administrator approval, helping organizations balance business continuity and security.

Fourth, operate in an auditable way. When security staff review event images, access should not be unlimited. Reasons and time windows should be recorded. A structure like MonitorDog's security audit process, with private-by-default images, limited review time, and history records, is important.

MonitorDog: Extending Insider Anomaly Detection to the Screen

The core of UEBA is not missing abnormal behavior by users with legitimate permissions. Many data leaks begin not because an unauthorized person hacked into the system, but because an authorized user handled information displayed on the screen inappropriately.

MonitorDog brings that moment into the scope of security operations. It records events, groups them into suspicious activities through scenarios, manages risk levels and review status, and can respond immediately with event lock or remote lock when needed.

Traditional UEBA focuses on login, account, network, and application logs. MonitorDog adds another signal: actual behavior in front of the screen. Smartphone filming attempts, multiple-person detection, absence from the seat, and screenshot attempts become security events that existing logs often cannot see.

---

Before UEBA is a large analytics platform, it is a basic question for security operations:

"Is this user's behavior normal right now?"

When that question extends to screen security, insider threat response becomes much more realistic. Sensitive information is ultimately exposed on the screen, and organizations need visibility into what happens in front of that screen.

If you want to see how MonitorDog detects and records smartphone filming attempts and suspicious activities in a real work environment, request a free demo.

Request a Demo

---

References

• IBM, "What is user behavior analytics (UBA)?": https://www.ibm.com/think/topics/user-behavior-analytics
• CISA, "Insider Threat Mitigation Guide": https://www.cisa.gov/resources-tools/resources/insider-threat-mitigation-guide
• Carnegie Mellon University SEI, "CERT Insider Threat Center": https://insights.sei.cmu.edu/insider-threat/
• Verizon, "2026 Data Breach Investigations Report": https://www.verizon.com/business/resources/reports/dbir/
• NIST, "SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations": https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final