User Behavior Analytics
Catch policy violations with Rules, Anomalies, and Risks. Confirm what happened with Live view, screenshots, and keystrokes. Available in Cloud or On-Premise.
What user behavior analytics software does on Windows endpoints
User behavior analytics (UBA) watches how people use company computers and helps security and IT teams notice activity that breaks policy. In employee monitoring, that usually means apps, websites, session timing, file transfers, messaging, and enough context to investigate an alert. It is not the same as product analytics tools that track clicks inside a SaaS app.
OctoWatch does this on Windows. You install a Grabber on each PC or on a Terminal Server / RDS host, assign Settings, Rules, Timetable, and Computer profiles, then review Anomalies and Risks in the Web Console. When you need proof, open Live view, screens, keystrokes, or files. This page explains that detection path. For the wider insider-risk program, see Insider Risk Management. For console triage of hits and outliers, see Risks & Anomalies. For investigation workflow after an alert, see Security Investigations.
UBA vs SIEM, UEBA, and employee monitoring
These terms get mixed together. Here is how they differ in practice.
SIEM tools pull logs from across your infrastructure and correlate events for a security operations team. OctoWatch is not a SIEM. It is Windows endpoint monitoring and DLP with rules, alerts, and forensic views on the workstation.
UEBA (user and entity behavior analytics) often means machine-learning baselines and risk scores across users, devices, and other entities. OctoWatch does not sell ML risk scores or entity analytics for servers and IoT. Detection here comes from Rules Profile conditions, Anomalies and Risks in the Web Console, and the channels you turn on in Settings profiles.
Employee monitoring is the full platform: activity, productivity, Live view, screens, messaging, and more. UBA on this page is the part that turns that data into policy and alerts. For the product overview, start with Employee Monitoring. If you are building a security program around insider threats, start with Insider Risk Management.
| Question | SIEM / platform UEBA | AD / identity UBA | OctoWatch endpoint UBA |
|---|---|---|---|
| Primary data | Infrastructure logs, network and security events | Windows security events, logons, directory changes | Grabber activity on Windows PCs and RDS sessions |
| Typical detection | Correlation rules, often ML risk scores | Per-user logon and file-volume baselines | Rules Profile conditions, Anomalies, Risks |
| Proof after an alert | Log context in the SOC tool | Event timelines around identity actions | Live, screens, Day Viewer, keystrokes, files |
| Enforcement on the PC | Usually handled by other controls | Identity and policy outside the audit view | Notify or block with Rules and Computer Profile filtering |
| Deployment | Security stack or cloud SIEM | Domain and server auditing | Cloud or On-Premise Web Console |
OctoWatch does not replace a SIEM or an Active Directory attack analyzer. It covers Windows endpoint user behavior inside employee monitoring and DLP.
Who it is for
Built for Windows workplaces. Other tools fit other jobs.
A good fit
Security, compliance, and IT teams that need rules-based alerts on Windows PCs and RDS, with Anomalies, Risks, and forensic proof in one Web Console, Cloud or On-Premise.
Look elsewhere if
You need SIEM-style UEBA on network logs, Active Directory-only anomaly reports, Mac or Linux agents, or productivity scores without security channels. For ops efficiency alone, see Productivity Analytics.
How OctoWatch turns behavior into action
Four clear steps from capture to evidence. No machine-learning risk engine required.
Observe
The Grabber records the Settings Profile channels you enable on each Windows PC or RDS session.
Set policy
Rules, Timetable, and Computer profiles define what is allowed, when recording runs, and what can be blocked.
Flag
Rule matches appear under Risks, with optional email. Anomalies helps you spot unusual patterns in Analytics.
Prove
Open Live, Screens, Day Viewer, Keystrokes, or Files to confirm what happened before you act.
What the Grabber observes
Choose channels in the Settings Profile. Open a feature page when you need more detail on one module.
Apps & web
Applications and websites
See what people launch and browse, including search queries. Details: Application & Website Monitoring and Search Query Monitoring.
Activity
Active and idle time
Session timing that helps explain off-hours or unusual work patterns. Details: Active & Idle Time Monitoring.
Keystrokes
Keystroke logging
Capture typed content for policy keywords and investigations. Details: Keystroke Logging.
Visual
Screenshots and video
Visual evidence around the time of an alert. Details: Screenshots & Video Recording and Day Viewer.
Channels
Email, IM, clipboard
Messaging and clipboard activity that can move sensitive text. Details: Email & IM Monitoring and Clipboard Monitoring.
Transfers
Files, USB, and print
File operations, removable media, and print jobs that often show data leaving the PC. Details: File, USB & Print Monitoring.
Network
Network and web forms
Interfaces, traffic summaries, and url-encoded or POST form submissions when those views are enabled. Details: Network Monitoring and Web Forms Monitoring.
Live
Live view and control
Watch a live session when an alert needs immediate context. Details: Live View & Remote Control.
Turn activity into policy
Alerts only help when policy is clear. Rules Profiles map conditions on monitored activity to actions such as notify or block. Computer Profiles turn on Internet Traffic Filtering and File Operation Filtering when you need enforcement on the endpoint. Settings Profiles choose which channels are recorded. Timetable Profiles can limit recording to work hours. Assign profiles by user or group so high-risk roles get tighter controls than everyone else.
Use Profiles & Access so only the right operators see Risks, Anomalies, and forensic views. More on profile design: Monitoring Profiles. OctoWatch ships with a set of example rules you can tune for stop words, sites, apps, and transfer paths. Changes usually apply in about five minutes. For conditions and alerts, see DLP Rules & Alerts. For blocking and channel prevention, see Data Loss Prevention.
Spot what does not fit
When a Rules Profile matches, the event can appear under Risks and trigger email if notifications are set up. Anomalies sits with the other Analytics views so you can review unusual patterns without reading every raw event first. Together they answer a simple question: what should I look at today?
Day-to-day triage of Risks and Anomalies is covered on Risks & Anomalies. OctoWatch does not assign automatic ML employee risk scores. You configure rules and review the hits and analytics views yourself.
From signal to proof
An alert without context wastes time. From a Risk hit you can open Screens near the trigger, Day Viewer for the timeline, Keystrokes or Files for channel detail, and Live view if the session is still running. That evidence path is the main difference between endpoint UBA with a Grabber and identity tools that only show logon anomalies.
Investigation order and case workflow: Security Investigations. Live remote view and control: Live View & Remote Control.
How it works
Same Grabber and Web Console in Cloud or On-Premise. Only hosting changes.
Create access
Cloud: create an account at app.octowatchdlp.com. On-Premise: install Server and the database, then configure the Admin Console.
Install Grabbers
Deploy on Windows PCs manually, with Group Policy, the Installation Utility, or a silent install. On Terminal Server and RDS hosts, the agent follows each session. See the User Guide.
Set profiles and review
Assign Settings, Rules, Timetable, and Computer profiles. Open Anomalies, Risks, and investigation views in the Web Console. Guides: Cloud and On-Premise.
Common use cases
Off-hours or unusual sessions
Rules and Timetable profiles catch activity outside expected hours. Open Risks, then Day Viewer or Live if the session is still active.
USB and file transfer spikes
File and removable-media rules catch bulk copy patterns. Open Risks, then Files and Screens near the hit.
Policy keywords in channels
Stop-word style conditions on keystrokes or messaging raise alerts when sensitive terms appear. Open Risks, then Keystrokes or Email/IM, then Screens.
Web or IM exfiltration attempts
Website filtering and messaging rules notify or block risky destinations. Open Risks, then messaging or network views, and Live when you need it. See Website Filtering.
Terminal Server and RDS sessions
The same Grabber follows each Windows Terminal Server or RDS session, so shared hosts still get per-user Rules, Risks, and proof. There is no separate Citrix module. See Terminal Server & RDS Monitoring.
Hybrid and remote company PCs
Cloud keeps Grabbers reporting when laptops leave the office. On-Premise fits sites that must keep Server and SQL on their own network. See Cloud and On-Premise.
UBA vs productivity analytics
Productivity analytics shows how time and apps break into productive and unproductive work for managers. User behavior analytics on this page asks a different question: did activity violate security policy, and what evidence proves it? Both use Grabber data. For scores, categorization, and ops reporting, use Productivity Analytics.
Operator access and monitoring notice
Who can open behavioral data matters as much as what the agent captures. Profiles & Access limits Web Console operators to the users and views they need. Monitoring runs in stealth by default under Additional settings on the Settings Profile. Turn on Show monitoring warning when policy requires open notice. You can also let users enable or disable monitoring, and use a Timetable profile to keep recording inside work hours. More on custody and console access: Security & Compliance. More on stealth vs transparent mode: Stealth & Transparent Monitoring.
Licensing
Licenses float by the number of active tracked users, not by hardware seats. Web Console operators are unlimited and do not use a license. Blocked users do not use a license either. Compare Time Tracking and Employee Monitoring, Cloud and On-Premise, and term length (including Lifetime on On-Premise) on Pricing. For API access to users, reports, and export, see the OctoWatch API.
Common questions
What is user behavior analytics (UBA)?
UBA collects user activity and highlights behavior that falls outside expected or allowed patterns. In OctoWatch that means Grabber data, Rules alerts, and Anomalies and Risks in the Web Console, with screens, keystrokes, and Live view for proof.
What is user behavior analytics software?
Software that turns endpoint or identity activity into alerts and investigation context. OctoWatch is Windows endpoint UBA inside employee monitoring and DLP. It is not SaaS product analytics and not a SIEM UEBA platform.
UBA vs UEBA?
UEBA often adds entity analytics and ML scoring across users and non-human assets. OctoWatch focuses on Windows users through the Grabber and does not market UEBA entity scoring or ML risk graphs.
UBA vs SIEM?
SIEM centralizes infrastructure logs and correlations. OctoWatch monitors Windows endpoints with a local Grabber and Web Console views. You can pull data through the API when that fits your stack, but OctoWatch is not a SIEM replacement.
Is OctoWatch ML or AI UBA?
No. Detection is rules-based, with Anomalies and Risks analytics views. There is no AI copilot, Shadow AI product, or automatic ML employee risk score.
How do Anomalies differ from Risks?
Risks focuses on Rules Profile hits and related alerts. Anomalies is an Analytics view for unusual patterns. Both help you prioritize review. Workflow detail: Risks & Anomalies.
Does it work only on Windows?
Yes. Grabbers monitor Windows workstations and Windows Terminal Server or RDS sessions. There is no Mac or Linux agent and no separate Citrix module.
Cloud or On-Premise?
Both support the same monitoring and rules model. Cloud stores encrypted data in the United States; vendors cannot access customer data. On-Premise keeps Server and SQL on your network. See Cloud and On-Premise.
How do rules and alerts work?
Rules Profiles map conditions to notify or block. Hits can appear under Risks and by email. Blocking needs the matching Computer Profile filters. Changes usually apply in about five minutes. See DLP Rules & Alerts.
Where do I investigate after an alert?
Open the Risk hit, then Screens, Day Viewer, Keystrokes, Files, or Live view as needed. Case flow: Security Investigations.
Is monitoring stealth or transparent?
Stealth is the default in Settings Profile additional options. Enable Show monitoring warning for open notice. Timetable limits and optional user self-control are available when policy requires them. See Stealth & Transparent Monitoring.
How does licensing work?
Licenses float by active tracked user. Console operators are unlimited. Compare Cloud and On-Premise terms on Pricing.
Questions about Rules, Anomalies, or deployment? Email support@octowatchdlp.com or use Contact us. Compare plans on Pricing.