Microsoft Defender for Business vs VbtEngine UEBA

Microsoft Defender for Business has no write-up on Specifiction yet; its figures are above.

VbtEngine UEBA analyzes user and entity behavior to surface anomalies and insider-threat signals, then assigns risk scores to findings. It uses existing FortiGate VPN and SSH logs from fw_vpn_log and fw_ssh_log, with no new agent required. The engine builds a 30-day behavioral baseline while excluding the latest 24 hours, and describes twelve anomaly types, including new users or source IPs, unusual hours, volume spikes, suspected account takeover, lateral movement, and suspected brute force. Related signals can be correlated so that two individually medium-risk signals may become a high-risk finding. Location filtering excludes internal, VPN, loopback, link-local, multicast, and CGNAT addresses; two IPs in the same /24 are not treated as different locations. Heavy scans run in a background worker while the main API reads a cache. Data, deduplication, and seven-day anomaly history are kept separate by tenant. Sequence correlation can automatically open a SIEM case after a brute-force lockout followed within an hour by specified anomalies. The technical summary specifies on-prem deployment.