A lot of legitimate work happens at 11pm, and so do many incidents. What matters is what else happens at the same time. Vedric treats off-hours activity as one part of a behavioral storyline, not as a standalone alert.
Currently supports Windows endpoints.
SOCs routinely ignore the "user logged in after hours" alert. Sales works late. Engineering pushes before launches. International teams work across unusual windows. Off-hours activity alone is low signal. Combined with first-time command shapes, authentication anomalies, or host-level network drift, it can be worth a review.
Most tools define "off-hours" with a calendar window. Anyone on a non-standard shift is flagged constantly, and the alert gets muted.
A 02:00 login by a global on-call SRE is normal for that role. The same login by an HR coordinator is not. Without peer baselines, a tool cannot tell the difference.
Even when off-hours activity is detected, most stacks raise it as a separate alert and leave people to connect it with command activity in another tool. In practice, that rarely happens.
UEBA modules see the login. They do not see what the user does after the session opens, which is where the relevant activity happens.
Vedric tracks observed activity windows and combines time-of-day deviation with command, privilege, authentication, and host-level network drift. A late login alone is context. A first-time privileged command with corroborating metadata can become a storyline.
The platform learns when each user normally works, including weekend cadence, recurring late shifts, and timezone variability. Off-hours is measured against the user's own pattern, not a single global window.
Peer baselines recognize on-call rotations, international coverage, and shift work as typical for the cohort, so off-hours activity that is normal for the role does not fire. The signal is stronger when the user is off-baseline both personally and against their peer group.
Off-hours activity is promoted only when other signals agree. Off-hours alone is context. Off-hours plus command drift, authentication anomalies, or host-level outbound-byte/new-destination-count drift can promote a storyline. Each signal stays labeled by what its collector actually observed.
This user has done weekend work for two years, so a weekend login is not unusual. What the session does after login is unusual.
A standalone off-hours alert would have been muted by the SOC weeks earlier. This detection worked because off-hours activity was one part of a multi-signal storyline, not an alert on its own.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is for teams who have stopped relying on standalone time-of-day alerts and want time-based drift to raise an alert only when it should.