Skip to content
SPECIFICTION
Get listed

Security Vision UEBA

securityvision.ru

WebWindowsLinuxAPISelf-hosted
Visit securityvision.ru
Spec score 7.9 #4 of 21 in User and Entity Behavior Analytics Software

What it is

Security Vision UEBA builds behavioral models for users, accounts, devices, hosts and processes, then detects deviations in activity and traffic. Its analysis combines correlation rules, statistical methods and machine learning to identify suspicious behavior and incidents. It can analyze raw data from data lakes, SIEM, next-generation firewalls, proxy servers, and Windows or Linux devices. Configured connectors support SIEM systems, Cisco, CheckPoint, Palo Alto and Juniper network devices, Squid and Blue Coat proxies, Kafka, Elasticsearch, and Windows and Linux logs. Users can add or adapt Sigma and correlation rules with a correlation rule editor. UEBA can enrich incident data and send events or incidents to SOAR or SIEM. Response actions can include adding entries to NGFW blocklists or SIEM active lists. Its API provides alarms, suspicious events and object alerts. Deployment is on premises; the maker says its machine-learning models run on customer infrastructure without sending data to the cloud. It is paid with individual pricing, and license type and support level affect cost.

Spec sheet

What it does
UEBA builds behavioral models and detects deviations involving users, accounts, devices, processes and traffic.Read 15 Oct 2026 · securityvision.ru
Purpose
UEBA builds behavioral models for users, accounts, devices, and processes and detects deviations in activity and traffic.Read 4 Oct 2026 · securityvision.ru
API
The product API can provide alarms, suspicious events, and alerts for objects.Read 4 Oct 2026 · securityvision.ru
Integrations
Documented connectors cover KUMA, MaxPatrol, Pangeo RADAR, RuSIEM, NEURODAT, ArcSight, QRadar, Splunk, CEF, LEEF, Cisco, Check Point, Palo Alto, Juniper, Squid, Blue Coat, Kafka and Elasticsearch.Read 15 Oct 2026 · securityvision.ru
Support
The maker lists standard and extended technical support as options that affect pricing.Read 4 Oct 2026 · securityvision.ru
Headquarters
Moscow, RussiaRead 4 Oct 2026 · securityvision.ru
Agent model
Deployments may be agentless or agent-based, and third-party agents can be used through connectors.Read 15 Oct 2026 · securityvision.ru
Analysis methods
The product combines correlation rules, statistical analysis, and machine learning to identify suspicious behavior and incidents.Read 4 Oct 2026 · securityvision.ru
Automated response
Configured actions can forward incidents to SOAR or SIEM, update SIEM active lists, block NGFW entries and block directory accounts.Read 15 Oct 2026 · securityvision.ru
Company background
Security Vision describes itself as a Russian company specializing in IT systems and says its first research began in 2007.Read 4 Oct 2026 · securityvision.ru
Company legal identity
LinkedIn identifies the maker as Security Intelligence LLC, branded Security Vision, a privately held Russian computer and network security company.Read 15 Oct 2026 · linkedin.com
Company licensing
LinkedIn says the company holds licenses meeting Russian FSB and FSTEC information-protection requirements and that its software is in the unified Russian programs register.Read 15 Oct 2026 · linkedin.com
Company scale
The official company page claims more than 600 automation projects, 40-plus Top-100 Russian customers, eight of the ten largest Russian banks and 20-plus MSSP users.Read 15 Oct 2026 · securityvision.ru
Company size
LinkedIn lists the company size as 51–200 employees and shows 71 employees on the company page.Read 15 Oct 2026 · linkedin.com
Company standards
The official company page states ISO 9001 and ISO/IEC 27001 compliance and required FSB/FSTEC licenses.Read 15 Oct 2026 · securityvision.ru
Compliance claims
The platform is listed in Russia's unified domestic-software register and the vendor states FSTEC, FSB and Ministry of Defence certifications or licenses.Read 15 Oct 2026 · securityvision.ru
Connector extensibility
A graphical no-code builder supports new integrations and normalization of incoming data.Read 15 Oct 2026 · securityvision.ru
Correlation and machine learning
The product combines about 30 correlation rules, roughly 50 statistical rules, machine-learning models and customer-traffic training.Read 15 Oct 2026 · securityvision.ru
Custom rules
Users can add or adapt Sigma and correlation rules, and the product includes a correlation rule editor.Read 4 Oct 2026 · securityvision.ru
Data analysis
It analyzes raw streams from data lakes, SIEM, NGFW, proxy servers and Windows/Linux systems.Read 15 Oct 2026 · securityvision.ru
Database support
PostgreSQL is the default free database; Jatoba and Microsoft SQL are also supported, with Elasticsearch and ClickHouse used where applicable.Read 15 Oct 2026 · securityvision.ru
Deployment architecture
Security Vision uses client-server web applications, microservices and deployable components on separate servers or virtual machines.Read 15 Oct 2026 · securityvision.ru
Documentation availability
The UEBA product page links downloadable presentation and product-description PDFs and a demo request.Read 15 Oct 2026 · securityvision.ru
Event sources
It analyzes raw data from sources including data lakes, SIEM, NGFW, proxy servers, and network and Windows/Linux devices.Read 4 Oct 2026 · securityvision.ru
Incident creation
Events are weighted and aggregated into incidents when configured counts or thresholds are exceeded, with whitelist and critical-system exceptions.Read 15 Oct 2026 · securityvision.ru
Incident response
The product can enrich incident data and send incidents or events to SOAR or SIEM, with response actions such as adding entries to NGFW blocklists or SIEM active lists.Read 4 Oct 2026 · securityvision.ru
Independent API report
Anti-Malware reported that the product API exposes object detections, suspicious events and alerts.Read 15 Oct 2026 · anti-malware.ru
Independent documentation limit
SecRadar says the public UEBA description is general, lacks a version and requires a technical guide to verify connectors, normalization, history and response behavior.Read 15 Oct 2026 · secradar.ru
Independent ML report
Anti-Malware reported supervised and unsupervised models, recurrent neural networks, mimic-process detection, customer-side processing and UI model tuning in the 2024 UEBA release.Read 15 Oct 2026 · anti-malware.ru
Independent product-scope limit
SecRadar reports that UEBA is a module within the broader Security Vision platform and has no separate registry entry or standalone certification listing.Read 15 Oct 2026 · secradar.ru
Investigation
Incident records include the triggering object, related objects and abnormal events for investigation.Read 15 Oct 2026 · securityvision.ru
License model
The vendor offers perpetual Capex licenses and time-limited Opex licenses; perpetual support is extended from the second year.Read 15 Oct 2026 · securityvision.ru
Limit: implementation effort
The same CISOclub comparison says substantial setup and optimization are needed for each organization.Read 15 Oct 2026 · cisoclub.ru
Low-code customization
Object, menu, workflow, report, analytics and connector designers are available for customization without source-code changes.Read 15 Oct 2026 · securityvision.ru
Maker headquarters
Intellectual Security LLC is listed at 57 Sadovnicheskaya Street, building 2, Moscow 115035, Russia.Read 15 Oct 2026 · securityvision.ru
Notable news: 2026
SecurityLab published a UEBA article on 5 August 2026 describing detection of credential theft, insider activity, lateral movement and suspicious domains.Read 15 Oct 2026 · securitylab.ru
On-premises processing
The maker says machine-learning models run on the customer's infrastructure without sending data to the cloud.Read 4 Oct 2026 · securityvision.ru
Platform API
The web portal includes an API service and separate Security Vision installations can exchange information through API calls.Read 15 Oct 2026 · securityvision.ru
Praise: deployment stack
The CISOclub comparison notes Linux and PostgreSQL deployment options that can reduce infrastructure costs.Read 15 Oct 2026 · cisoclub.ru
Praise: flexibility
A CISOclub comparison describes Security Vision as the most flexible product, supporting complex processes and many connector types.Read 15 Oct 2026 · cisoclub.ru
Pricing and licensing
The maker offers individual pricing and says licenses may be perpetual or time-limited; support level also affects the final cost.Read 4 Oct 2026 · securityvision.ru
Rights holder
Exclusive software rights are attributed to Intellectual Security LLC, with Russian registry entry 364 dated 8 April 2016.Read 15 Oct 2026 · securityvision.ru
Security and certification
The maker says Security Vision is FSTEC-certified at trust level 4 and meets GOST R ISO 9001-2015 and GOST R ISO/IEC 27001 requirements.Read 4 Oct 2026 · securityvision.ru
Security testing
The vendor says every release undergoes static and dynamic application security testing.Read 15 Oct 2026 · securityvision.ru
Static analytics
The product includes several dozen built-in statistical behavior rules.Read 15 Oct 2026 · securityvision.ru
Supported operating systems
Supported systems include CentOS Stream 8+, RHEL 8+, Ubuntu 20.04+, Debian 10+, Astra Linux, Alt, Oracle Linux, EDIT OS, ROSA, AlmaLinux, AlterOS and Windows Server 2016+.Read 15 Oct 2026 · securityvision.ru

Plans and prices

Security Vision UEBA Priced on request modules · connector count or events per second · optional nodes · support level · perpetual or term license · multitenancy Read 15 Oct 2026 · securityvision.ru

Every Security Vision UEBA plan and price →

Strong points and limits

Strong points

  • Combines rules, statistical analysis and machine learning.
  • Supports Sigma and correlation rule customization.
  • Can enrich and route incidents to SOAR or SIEM.
  • Machine-learning models run on customer infrastructure, according to the maker.

Limits

  • Pricing is individually set and not listed.
  • License type and support level affect cost.
  • Deployment is on premises.

Who it suits

It suits organizations seeking on-premises analysis of behavior across users, devices and systems, with integrations to security data sources and response tools. It may fit teams that need configurable rules and incident handoff to SOAR or SIEM.

Verdict

Security Vision UEBA pairs behavioral analytics with configurable rules and incident response integrations. Its on-premises deployment and individually priced licensing are important considerations for prospective buyers.

Where Specifiction places it

Alternatives to Security Vision UEBAAll alternatives →