User and Entity Behavior Analytics (UEBA) usually scores authentication logs. Vedric adds endpoint process and command metadata, security-event cadence, DNS/network aggregates, sensitive-extension inventory, and removable-media writes.
Currently supports Windows endpoints.
Most UEBA is a dashboard on top of authentication logs. It shows who logged in, when, from where, and how often. That signal is real, but it covers a small part of endpoint behavior. Process launches, command-line shapes, authentication-event cadence, DNS history, and host-level network drift happen below the authentication layer. Vedric does not claim per-file reads or content inspection.
Most UEBA inputs are AD events, VPN logs, and SSO sessions. The user looks normal at login; the change is in what they do afterward. UEBA does not have endpoint events in its index.
Log aggregation reduces behavior to counts and sessions. A specific PowerShell command with specific arguments, in a specific timeline, compared to a specific peer baseline: that detail is lost in aggregation.
Peer groups are often defined by AD group membership and are rarely re-clustered. A user whose actual behavior moves away from their peers keeps being scored against the wrong cohort.
UEBA scores are usually per event or per session. The most useful signal is correlation across days, which UEBA modules typically surface only in retrospective hunts, not as a live alert.
Vedric collects endpoint process, command, authentication, DNS/network aggregate, sensitive-extension inventory, and removable-media metadata. It then correlates supported deviations across user, peer, and endpoint contexts, with an evidence chain.
The agent reads user behavior on the endpoint, where the actions happen. The login matters less than what the session does after it opens.
Peer groups are derived from observed behavior as well as organizational metadata. A user who has actually moved roles is reclustered, so the cohort comparison stays meaningful as the organization changes.
A deviation on Monday and a deviation on Friday on the same identity are correlated into one storyline if the underlying pattern matches. Single events are logged; storylines become alerts.
A senior engineer with broad access starts working slightly later, runs slightly more queries, and touches a few systems they have not used in months. Each event is well within their entitlements.
Same user, same authentication pattern, same SSO source. UEBA had nothing actionable because none of the authentication dimensions changed enough. Vedric detected the behavior after login.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is for teams whose UEBA is not giving them what they need and who want endpoint behavioral signal as a complement, not a replacement.