Designing a UEBA Pipeline: Baselines, Anomaly Detection, and Risk Scoring

Building a UEBA pipeline that delivers value involves careful design at every stage. The data you collect, the baselines you build, the anomaly methods you choose, and the way you turn raw signals into risk scores all shape whether analysts trust the output or learn to ignore it. This course walks through those decisions in the order they typically arise. You will work through written design exercises that mirror how a security data team would plan a UEBA pipeline for a real organization. The emphasis is on the practical tradeoffs that decide whether the system improves detection without overwhelming analysts. What you'll learn: - Plan data collection from authentication, access, and activity logs across cloud and on-premises systems - Design baseline modeling approaches that account for individual roles, peer groups, and time patterns - Compare anomaly detection methods including statistical, clustering, and modern deep learning approaches - Build risk scoring systems that combine multiple signals into actionable alerts - Plan evaluation routines that test the pipeline against realistic insider threat and compromise scenarios - Design feedback loops that allow analyst decisions to improve the baselines and scoring over time The course progresses from data collection through baseline modeling, anomaly detection, risk scoring, and evaluation. A capstone written exercise asks you to draft a one-page design for a UEBA pipeline targeted at a specific organization type and threat profile. This course is designed for security analysts, data engineers entering security work, and computer science students. No deep UEBA experience is required. The course treats the pipeline as a design problem you can reason about on paper before any tooling decisions are made.