Design User Behavior Analytics - System Design | WinJob

Problem Statement and UEBA Mission

Exabeam-class UEBA starts with a crisp mission: detect compromised credentials and insider misuse faster than rule-only SIEM.

Design anchors (1)

Focus: insider threat detection via behavioral baselines across identities and entities.
Invariant: tenant-scoped partitions never leak cross-customer features in queries or caches.
Operability: every alert carries explainable top features and a link to stitched sessions.

Mechanism

Collectors pull IdP, VPN, proxy, and SaaS audit streams into tenant-partitioned Kafka topics with schema registry enforcement.

Failure drills

Collector outage buffers 15m locally then replays with monotonic event ids.

Cost and capacity

At 850K /s for Peak events/s, right-size stream tasks before GPU inference. Chargeback tenants on scored entities per day, not raw ingest alone.

Signal	Target
Peak events/s	850K /s
Entities tracked	12M
Baseline window	30 days
MTTD target	20 min

javaOne Dark Pro

1 public record RiskContext(String tenantId, String userId, double zGeo, int newDevices) {
2   public String dedupeKey(String ruleId) { return tenantId + ":" + userId + ":" + ruleId; }
3 }

pythonOne Dark Pro

1 def peer_zscore(value: float, cohort: list[float]) -> float:
2     mu = sum(cohort) / len(cohort)
3     var = sum((x - mu) ** 2 for x in cohort) / max(len(cohort) - 1, 1)
4     return (value - mu) / (var ** 0.5 + 1e-6)

typescriptOne Dark Pro

1 export interface BehaviorFeature {
2   userId: string;
3   offHoursRatio: number;
4   rareActions: number;
5 }
6  
7 export function mergeSession(prev: number, gapMin: number, maxGap = 30): number {
8   return gapMin <= maxGap ? prev : prev + 1;
9 }

Why interviewers care

User Behavior Analytics interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and UEBA Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Iinsider threat detection via behavioral baselines across identities and entities
•Metrics: Peak events/s, Entities tracked, Baseline window, MTTD target
•Peer baselines plus explainable risk scoring.

1	public record RiskContext(String tenantId, String userId, double zGeo, int newDevices) {
2	public String dedupeKey(String ruleId) { return tenantId + ":" + userId + ":" + ruleId; }
3	}

1	def peer_zscore(value: float, cohort: list[float]) -> float:
2	mu = sum(cohort) / len(cohort)
3	var = sum((x - mu) ** 2 for x in cohort) / max(len(cohort) - 1, 1)
4	return (value - mu) / (var ** 0.5 + 1e-6)

1	export interface BehaviorFeature {
2	userId: string;
3	offHoursRatio: number;
4	rareActions: number;
5	}
6
7	export function mergeSession(prev: number, gapMin: number, maxGap = 30): number {
8	return gapMin <= maxGap ? prev : prev + 1;
9	}