DTEX Insider Risk Management vs VbtEngine UEBA

DTEX Insider Risk Management helps enterprise security teams examine user behavior and activity around data and AI to identify potential insider-driven breaches. It offers preconfigured and customizable behavior indicators, user baselines, anomaly detection, and risk scoring. Investigations can draw on MITRE ATT&CK-aligned profiling and endpoint telemetry such as event logs, registry changes, and credential usage to examine signs including lateral movement and privilege escalation. Preconfigured DLP patterns flag risky behavior, while data lineage tracks file interactions and changes. A threat-hunting engine supports searches across insider data using an open query language and customizable visualizations. The platform covers users, endpoints, servers, applications, data, and AI activity across Linux, macOS, Windows, and web. DTEX describes pseudonymization that masks personal identifiers and can be reversed for escalated investigations. It reports metadata collection of about 5 MB per user per day, with deployment materials giving a 3–5 MB range. Pricing is available on request.

VbtEngine UEBA analyzes user and entity behavior to surface anomalies and insider-threat signals, then assigns risk scores to findings. It uses existing FortiGate VPN and SSH logs from fw_vpn_log and fw_ssh_log, with no new agent required. The engine builds a 30-day behavioral baseline while excluding the latest 24 hours, and describes twelve anomaly types, including new users or source IPs, unusual hours, volume spikes, suspected account takeover, lateral movement, and suspected brute force. Related signals can be correlated so that two individually medium-risk signals may become a high-risk finding. Location filtering excludes internal, VPN, loopback, link-local, multicast, and CGNAT addresses; two IPs in the same /24 are not treated as different locations. Heavy scans run in a background worker while the main API reads a cache. Data, deduplication, and seven-day anomaly history are kept separate by tenant. Sequence correlation can automatically open a SIEM case after a brute-force lockout followed within an hour by specified anomalies. The technical summary specifies on-prem deployment.