CyberSight: User Behavior Analytics

Chronological Timelines

Reconstruct what happened. CyberSight’s Timeline provides a chronological, hour-by-hour view of user activity designed for incident investigation. It shows active time, idle time, streaming, and device states alongside a filterable events chart and top-activity breakdown.

When you need to understand the full sequence of events around a security incident, the CyberSight Timeline compresses multi-tool, multi-day investigations into a single view. Drill into any point on the events chart to jump directly to the underlying activity logs.

Threat and Risk Insight

Know where risk is concentrated across your environment. CyberSight’s Threat Trends aggregates threat intelligence across your users and surfaces what matters, without requiring you to manually filter through individual event logs.

See which threat categories are appearing most frequently, identify your riskiest users at a glance, and track whether observed threat activity is increasing or decreasing over time.

All threat data is exportable via CSV through the API for reporting and integration into your existing workflows.

User Behavior Activity Logs

Understand exactly which applications and websites your users are visiting, which devices they’re using, what they are doing, and for how long.

Find unauthorized/unmanaged apps and shadow IT. Surface early indicators of compromise based on anomalous behavioral patterns and unexpected activity—such as new applications opening while the device is idle or unfamiliar websites loading automatically.

Close security gaps and reduce potential exposure through proactive policy monitoring and updates.