UEBA and UBA for SaaS, without the enterprise overhead.
User Behavior Analytics (UBA) and User and Entity Behavior Analytics (UEBA) describe the same powerful idea: you can detect bad actors by establishing a behavioral baseline for every user and alerting on deviations. UEBA extends UBA to non-user entities like service accounts, devices, and infrastructure — but the analytical core is identical, and most vendors use the two terms interchangeably.
Traditional UEBA products were built around that idea for enterprise insider-threat detection, with all the SOC tooling, SIEM integration, and rule tuning that implies. Dregs takes the same idea and points it at a different problem: external users in your SaaS application — free trial abusers, fake signups, bots, scrapers, and abusive customers. Same behavioral analytics pattern; different problem space; built for product and engineering teams instead of security operations centers.
What Are UBA and UEBA
User Behavior Analytics (UBA) is the practice of establishing a behavioral profile for every user in a system, then continuously checking whether their current behavior matches their baseline. User and Entity Behavior Analytics (UEBA) extends the same pattern to non-user entities — service accounts, hosts, applications, network endpoints. Anomalies surface as alerts: a user accessing files they've never touched, a service account behaving like a human, a customer suddenly executing actions at automation speed.
The categories emerged from SIEM tooling in the mid-2010s as Gartner's response to the limitations of rule-based intrusion detection. Where rules say "alert when X happens," UBA and UEBA say "alert when this user does something they've never done before, or that no real user does." The pattern caught on because it generalizes — you can apply it to any domain where individual behavior is observable and "normal" varies per actor.
For Dregs's purpose — external users in a SaaS application — the practical scope is UBA: you're watching user identities, not internal infrastructure entities. The page uses both terms because the established products in this space (Splunk UBA, Exabeam, Securonix, Microsoft Defender for Identity) market interchangeably under either label, and the underlying analytical pattern is identical.
UBA for External Users
Most UBA and UEBA products are built for one specific application of the pattern: insider-threat detection inside enterprise environments. Splunk UBA, Exabeam, Securonix, and Microsoft Defender for Identity all assume you're watching employees, contractors, and service accounts in an IAM-rich environment with SIEM integration. The buyer is a SOC team. The use case is a malicious or compromised insider.
SaaS abuse is the same analytical problem with a different cast: the actors are external signups instead of employees, the data source is your application event stream instead of IAM logs, and the action is automated abuse prevention instead of SOC investigation. Dregs is UBA shaped for that problem — per-user behavioral analytics for the people using your application, not the people working inside your company.
How Dregs Does UBA / UEBA
Three core components, working together on every event:
- Per-user baselining — every identity in your system builds a behavioral profile from its events. Navigation patterns, timing, session structure, depth of engagement, all aggregated and updated in real time.
- Population baselining — the same signals are aggregated across your real-customer cohort to define what legitimate usage looks like for your specific application.
- Continuous deviation scoring — every event a user generates updates their Behavior score against both baselines, flagging users whose patterns diverge from what they've historically done or what real customers typically do.
The output is a continuous Behavior score on every identity, sitting alongside the three other Dregs scores (Humanity, Authenticity, Uniqueness). Together, they give you a complete fraud risk view per user — not just "this is an anomaly" but "this is the kind of anomaly you care about, with this much confidence, traceable back to these specific observations."
The "Entities" in Dregs (Why UBA Is the More Honest Label)
Traditional UEBA tracks users, service accounts, hosts, applications, and IP addresses as distinct entity types — and the "E" in UEBA earns its keep when there's a real distinction between user activity and machine-to-machine behavior worth modeling separately. Dregs's entity model is simpler because the problem space is narrower:
Dregs links these entities into a graph automatically. Identities link to devices through shared usage, identities link to other identities through shared devices and behavioral similarity, and the graph supports walk-based investigation when you want to unwind a fraud ring.
Strictly speaking, that makes Dregs closer to UBA than to UEBA — the behavioral baseline is per-user-identity, with devices and events as supporting context rather than first-class behavioral subjects. Both labels describe what Dregs does to a useful approximation, but if you have to pick the more honest one, UBA is it.
What Dregs Does Differently
When Traditional UBA / UEBA Is Right
Dregs is not built for enterprise insider-threat detection. If you're trying to catch employees exfiltrating data, monitor service-to-service authentication anomalies, or integrate behavioral signals into a broader SIEM workflow, the established UBA and UEBA products are a better fit. Dregs doesn't ingest IAM logs, doesn't model privileged-user hierarchies, and doesn't integrate with SIEM platforms.
The decision is mostly about who you're watching. If the entities you care about are your own employees and infrastructure, you want enterprise UBA / UEBA. If they're external users in your SaaS application, you want what Dregs does.
Where Dregs UBA Earns Its Keep
Bot Detection
Inhuman timing and repetitive patterns are the cleanest behavioral anomalies.
Free Trial Abuse
Repeat freeloaders show up as users with prior-knowledge navigation patterns.
Credential Stuffing
Velocity, identity cycling, and timing baselines catch stuffing before it succeeds.
Pricing
Dregs bills per active identity per month. Plans start at $17/month and include the full platform — fingerprinting, fraud scoring, behavioral analytics, identity graph, alerts, escalations, and webhooks. See the pricing page for details.
Frequently Asked Questions
Q: What's the difference between UBA and UEBA?
A: UBA stands for User Behavior Analytics. UEBA adds the "E" for Entity — extending the same analytical pattern to non-user actors like service accounts, hosts, applications, and network endpoints. The terms emerged within a year or two of each other (UBA around 2014–2015, UEBA shortly after as Gartner pushed the broader scope) and many vendors still use them interchangeably. For external SaaS users — signups, customers, prospects — the distinction barely matters: you're watching users, not entities, so what you actually need is UBA. Dregs is shaped for that case. The UEBA framing is here because most established products in the category market under the broader acronym.
Q: What is UEBA?
A: UEBA stands for User and Entity Behavior Analytics. It's a security category that emerged from SIEM tooling — systems that establish a behavioral baseline for every user and entity in an environment, then alert on anomalies. Traditional UEBA products (Splunk UBA, Exabeam, Securonix, Microsoft Defender for Identity) target enterprise insider-threat detection: spotting an employee whose access patterns suddenly look like data exfiltration, or a service account behaving like a compromised credential. Dregs uses the same pattern for a different problem — spotting external users (signups, customers, prospects) whose behavior doesn't match a legitimate customer.
Q: How is Dregs different from traditional UEBA tools?
A: Traditional UEBA is enterprise security software focused on insider threats. It runs against your IAM logs, file access logs, and infrastructure event streams, and the buyer is typically a SOC team. Dregs runs against your SaaS application's user event stream — the same events you'd send to product analytics — and the buyer is typically a product, growth, or trust-and-safety team. Same analytical pattern, different problem space, very different operational shape.
Q: Do I need a SOC team to use Dregs?
A: No. Traditional UEBA products require dedicated security analysts to tune detection rules, triage alerts, and integrate with broader SIEM workflows. Dregs is built for product and engineering teams: 22 analyzers run automatically with no rule writing, fraud scores update continuously, and webhooks let your application act on signals without anyone watching a console. Most teams have Dregs running with no dedicated security headcount.
Q: What entities does Dregs track?
A: Three primary entity types: identities (your users), devices (the browsers and endpoints they use), and events (their actions in your application). Dregs builds behavioral baselines per identity, links related identities through shared devices and behavioral similarity, and aggregates everything into per-identity fraud scores updated in real time. Unlike traditional UEBA, there's no concept of internal service accounts or privileged users — Dregs assumes every entity is an external user with a signup, login, and event history.
Q: Can Dregs replace a UEBA product like Splunk UBA or Exabeam?
A: For external user fraud, yes. For traditional insider-threat detection, no — Dregs doesn't ingest IAM logs, doesn't model service-to-service authentication, and doesn't integrate with SIEM platforms. If your problem is detecting employees with anomalous internal access patterns, traditional UEBA is the right category. If your problem is catching freeloaders, bots, and abusive customers in your SaaS application, Dregs is the right shape.
Q: Does Dregs use machine learning for behavioral analytics?
A: Dregs's analyzers combine deterministic signal extraction (timing, navigation patterns, similarity functions) with statistical baselining against your real-customer behavior. The four scores aggregate analyzer observations using weighted averages of value and confidence — interpretable enough that you can always trace a score back to specific signals. There's no opaque ML black box producing unexplained verdicts. On the Advanced plan, you can write custom analyzers in JavaScript that introduce whatever logic you want, including ML inference if you have your own models.
UBA and UEBA for the users you actually have.
Drop the Dregs tracking script into your application and start scoring every external user behaviorally — no SOC, no rule tuning, no SIEM integration project.
Schedule a Demo