Skip to content
SPECIFICTION
Get listed

VbtEngine UEBA

vbtengine.com

WebSelf-hosted
Visit vbtengine.com
Spec score 6.8 #13 of 21 in User and Entity Behavior Analytics Software

What it is

VbtEngine UEBA analyzes user and entity behavior to surface anomalies and insider-threat signals, then assigns risk scores to findings. It uses existing FortiGate VPN and SSH logs from fw_vpn_log and fw_ssh_log, with no new agent required. The engine builds a 30-day behavioral baseline while excluding the latest 24 hours, and describes twelve anomaly types, including new users or source IPs, unusual hours, volume spikes, suspected account takeover, lateral movement, and suspected brute force. Related signals can be correlated so that two individually medium-risk signals may become a high-risk finding. Location filtering excludes internal, VPN, loopback, link-local, multicast, and CGNAT addresses; two IPs in the same /24 are not treated as different locations. Heavy scans run in a background worker while the main API reads a cache. Data, deduplication, and seven-day anomaly history are kept separate by tenant. Sequence correlation can automatically open a SIEM case after a brute-force lockout followed within an hour by specified anomalies. The technical summary specifies on-prem deployment.

Spec sheet

Purpose
UEBA learns user and entity behavior to surface anomalies and insider-threat signals with a risk score.Read 1 Oct 2026 · vbtengine.com
Deployment
The technical summary lists deployment as on-prem.Read 1 Oct 2026 · vbtengine.com
Compliance
The compliance module supports live assessment frameworks including CIS v8, ISO 27001, NIST CSF 2.0, KVKK, PCI-DSS, SOC 2 and 5651.Read 1 Oct 2026 · vbtengine.com
Support
Technical support is available on weekdays from 09:00 to 18:00 Istanbul time (GMT+3).Read 1 Oct 2026 · vbtengine.com
Company
VBT Yazılım A.Ş. was established on 24 June 1993 to provide software, hardware and information-technology consultancy services.Read 1 Oct 2026 · vbt.com.tr
Maker
VBT Yazılım A.Ş. says it was established on 24 June 1993 and lists an Istanbul address.Read 30 Sep 2026 · vbt.com.tr
Access control
The administration module defines more than 70 atomic permissions across more than 25 domains and includes seven built-in roles.Read 1 Oct 2026 · vbtengine.com
Anomaly detection
The engine produces twelve anomaly types, including new users, new source IPs, unusual hours, volume spikes, account takeover suspicion, lateral movement and suspected brute force.Read 1 Oct 2026 · vbtengine.com
Baseline
It builds a 30-day behavioral baseline that excludes the most recent 24 hours.Read 30 Sep 2026 · vbtengine.com
Behavior baseline
It builds a 30-day behavioral baseline while excluding the last 24 hours.Read 1 Oct 2026 · vbtengine.com
Connectors
The platform provides LDAP/LDAPS Active Directory synchronization plus Jira, ServiceNow, Slack, Teams, PagerDuty, Discord and generic JSON webhook integrations.Read 1 Oct 2026 · vbtengine.com
Detection
The engine describes twelve anomaly types, including new source IP, unusual hour, dormant reactivation, suspected account takeover, lateral movement, and suspected brute force.Read 30 Sep 2026 · vbtengine.com
Log sources
The module uses existing FortiGate VPN and SSH logs, specifically fw_vpn_log and fw_ssh_log, without a new agent.Read 1 Oct 2026 · vbtengine.com
Multi-tenancy
A single scan buckets data per tenant, with separate anomaly history and tenant-specific slices.Read 1 Oct 2026 · vbtengine.com
Noise filtering
RFC1918, CGNAT, loopback and link-local addresses are discarded as location signals, and only public routable IPs count.Read 1 Oct 2026 · vbtengine.com
Performance
Heavy scans run in an isolated background worker so the main API process is not blocked.Read 1 Oct 2026 · vbtengine.com
Pricing and access
The UEBA page offers a demo request and does not state a price or trial terms.Read 30 Sep 2026 · vbtengine.com
Processing
Heavy log scans run in a background worker, while the main API reads a cache and does not scan fw_logs.db synchronously.Read 30 Sep 2026 · vbtengine.com
Risk correlation
One medium-risk signal combined with another can escalate into a high-risk finding.Read 1 Oct 2026 · vbtengine.com
Risk scoring
Certain signals can be correlated so that two individually medium-risk signals escalate into a high-risk finding.Read 30 Sep 2026 · vbtengine.com
SIEM integration
High-risk UEBA findings feed SIEM sequence correlation and can automatically open cases after specified brute-force-related anomalies.Read 1 Oct 2026 · vbtengine.com

Strong points and limits

Strong points

  • Uses existing FortiGate VPN and SSH logs
  • Does not require a new agent
  • Separates anomaly history by tenant
  • Can automatically open SIEM cases through sequence correlation

Limits

  • Pricing is available on request
  • No trial terms are stated
  • The listed log sources are FortiGate VPN and SSH

Who it suits

It may suit organizations using FortiGate VPN and SSH logs that want behavioral anomaly detection, tenant separation, and SIEM case automation. The technical summary specifies on-prem deployment.

Verdict

VbtEngine UEBA describes its baseline, anomaly categories, filtering, and tenant separation in specific terms. Request a demo to assess fit and clarify pricing and trial conditions.

Where Specifiction places it

Alternatives to VbtEngine UEBAAll alternatives →