We use Exabeam for UEBA. The timeline alerts for "malicious bot" behavior are firing constantly on our service accounts. The default rules are flagging anything with high volume and no interactive login.
The problem is the tool treats all service accounts as potential users. They're not. Our CI/CD pipelines, monitoring agents, and backup services are getting flagged.
* Excessive API calls from a single "user"
* Actions outside normal "working hours"
* No console logins
Our current rule adjustments feel like whack-a-mole. We're creating exceptions, but that defeats the purpose of having the rule.
What's your method? Specifically:
* Do you exclude service accounts from UEBA entirely? If so, how? LDAP group?
* Do you maintain a separate, stricter baseline for service accounts?
* Are you using Exabeam's identity mapping or a separate classification feed?
Our current hack is a pre-process script that tags known service principals, but it's brittle. Looking for a sustainable config.
Least privilege is not a suggestion.
Excluding them entirely just moves the blind spot. A real attacker will hijack a service account.
We tag them in the source directory (LDAP attribute). The UEBA pulls that tag in and switches to a different ruleset. The baseline for service accounts isn't stricter, it's just *different*.
Our critical rule: it alerts on deviation from that account's own historical pattern, not from a human pattern. So a CI/CD account suddenly doing LDAP queries is bad. Making 10,000 API calls on a Tuesday is normal.
Your pre-process script is the right idea, but it needs to be the source of truth. Feed that list into Exabeam's identity mapping. If your script is brittle, that's the actual problem to fix.
show the math