Gurucul UEBA
A stolen credential does nothing malformed — Gurucul UEBA baselines every user and entity and scores the deviation, which is the only way to catch an attacker who logs in correctly and does permitted things. It is the capability the company was founded on in 2010, not one it acquired.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Where data lives
Yours, if you self-host
Gartner’s own 2025 MQ text confirms the platform runs SaaS, cloud OR self-hosted. Self-hosted puts collection scope and physical storage under your control — on-premises or your own cloud account, in India if you choose — which is how you hold 180 days of logs in Indian jurisdiction and evidence it.
Two things we could NOT verify
Air-gap, and any India region
A genuine air gap is marketed but we could not confirm it independently, and self-hosted is not the same thing — air-gap affects licence activation, threat-intel updates and support access. We also found no evidence of a vendor-run India data region. Get both in writing before you commit.
Check which obligation genuinely binds you; the hard-line reading is oversold constantly, on-premises platform vendors among the culprits — so treat our incentive with the same caution. CERT-In’s Directions of April 2022 set a rolling 180-day retention on ICT logs, to be held “within the Indian jurisdiction”, while its own FAQ of May 2022 (Q35) permits offshore storage provided the logs can be produced within a reasonable period — financial-transaction records carry the hard in-India duty. It is the sector regulator that removes the doubt: IRDAI’s 2023 audit annexure asks insurers a yes/no question on whether ICT infrastructure logs are held in India, and they must be able to answer yes. If that is you, self-hosting stops being a preference. Bear in mind that India-based people and India-stored data are not the same — Pune has a real engineering centre, which is no data region.
Quick answer
The Gurucul platform family
This page covers Gurucul UEBA — the behavioural analytics. The other pillars:
Quick facts
30-second orientation- Product
- Gurucul UEBA — on the REVEAL platform
- Vendor
- Gurucul — founder-CEO Saryu Nayyar, still in post
- Heritage
- The founding capability, built 2010 — not acquired
- Sold as
- Its own product — on REVEAL or beside your SIEM
- What it catches
- Stolen credentials and insider misuse — attacks that break no rule
- Deployment
- Follows the platform: SaaS, cloud or self-hosted
- Hard dependency
- Identity-data quality — stale directory, worthless peer groups
- Time to trust
- Weeks of baselining before output should be acted on
- Data residency
- Yours if self-hosted; no vendor India region found
- Data processing
- Same platform as the SIEM — one data model, no second copy
- Buy in India via
- TechBag — identity-readiness scoping, INR, GST
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Analytics that learn how each user and entity normally behaves and score deviation — the capability Gurucul was founded on in 2010 and grew a SIEM around.
Rules-only detection vs Gurucul UEBA — the honest table
What behavioural baselining changes about catching an attacker who logs in correctly.
| Dimension | Rule-based SIEM alone | Gurucul UEBA |
|---|---|---|
| Detection basis | Signatures and correlation rules | Per-user and peer-group baselines |
| Stolen credentials | Valid login, nothing to match | Deviation from that user’s normal scores |
| Insider misuse | Permitted access, so silent | Unusual volume, hour or resource flags it |
| Evidence | Analyst stitches events by hand | Link Chain Analysis assembles the case |
| Existing SIEM | Replace it to get analytics | Can run alongside the SIEM you keep |
| Identity context | Activity only | Activity weighed against entitlements |
| Honest caveat | — | Weeks of baselining; directory quality decides it |
| Best fit | — | Credential- and insider-led threat models |
Behavioural baselining is the edge — if your threat model is malware-led, a strong EDR may matter more (TechBag sells those too).
The six pieces behind Gurucul UEBA
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Data ingestion
Pulls identity, authentication, endpoint, network and cloud activity from REVEAL’s collectors or from a SIEM you keep. Gurucul cites a customer running its UEBA to augment Splunk.
Entity Intelligence Engine
Stitches accounts, devices and service identities into one entity, so behaviour on the VPN, the laptop and the cloud console is judged as one person’s activity.
Model library
Gurucul says it ships more than 5,000 glass-box machine-learning models. Glass-box matters: an analyst can see which behaviour moved a score, which makes a finding defensible.
Peer-group analytics
Each user is compared with their own history and with a dynamically built peer group, so a clerk pulling a trader’s data volume stands out even on day one of the pattern.
Risk scoring
Anomalies accumulate into a real-time risk score per entity, weighted by entitlements, so a dormant admin account waking up outranks a noisy but harmless laptop.
Link Chain Analysis
Gurucul’s patented Link Chain Analysis stitches related anomalies and context into a case of evidence, so the analyst reviews one chain instead of rebuilding the sequence.
Baselines per user and entity, scored against peers and entitlements — on REVEAL, or alongside the SIEM you already run.
Ten capabilities. Baseline, score, investigate.
Gurucul UEBA learns how each user, device and service account normally behaves, scores the deviation, and hands analysts the evidence chain. Here is what sits in each layer.
Identity and activity feeds
Directory, IAM, VPN, endpoint, cloud and SaaS activity feed the models — the data that shows how people actually work.
Runs beside your SIEM
Can consume data from a SIEM you already own, so behavioural detection does not wait on a migration.
Entity resolution
Accounts, devices and service identities resolved to one entity before any baseline is built.
Per-entity baselines
Learns normal hours, systems, volumes and sequences for every user, host and service account.
Dynamic peer groups
Compares each user with people doing similar work, not only with their own history.
Compromised-account detection
Flags valid logins used abnormally — dormant accounts waking, privilege jumps, unfamiliar hosts.
Insider misuse
Surfaces data staging, unusual bulk access and entitlement abuse that no rule describes.
Real-time risk scores
Anomalies accumulate per entity, weighted by what that entity is entitled to do.
Link Chain Analysis
Related anomalies assembled into one evidence chain an analyst can read and defend.
Hand-off to response
High-scoring entities can be passed to SOAR playbooks for containment — stage them before they act.
Watch Gurucul UEBA in action
The behavioural analytics demonstrated, and the platform it runs on.
REVEAL Demo: Advanced Analytics
The behavioural analytics, demonstrated.
Gurucul REVEAL — Platform Overview
Where the analytics sit.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Catch the login that breaks no rule.
Here’s what genuinely sets Gurucul UEBA apart (and where Securonix or Exabeam may fit better).
It catches the attack that breaks no rule
An attacker with stolen credentials signs in correctly, at a plausible hour, and accesses only what the account allows, so no rule fires. Only knowing what’s normal for that user and their peer group, and scoring the deviation, exposes it — the same logic that catches an insider misusing legitimate access.
Built first, not bolted on
Most UEBA was bolted onto an existing SIEM by acquisition, leaving two consoles and two data stores. Gurucul’s analytics came first in 2010 and the SIEM grew around them, so a risk score and its events share one platform. An analyst investigating a score of 87 clicks through rather than filing a request.
Identity context, not just activity
Behavioural scoring is stronger when it knows entitlements as well as activity. With identity analytics on the same platform, deviation is judged against access: dormant for a year then used, or permissions piled up across three role changes now used at once. That separates real findings from someone doing a new job.
The honest dependency: your directory decides the outcome
Peer-group analysis takes its groupings from your identity data. A stale directory — active leavers, wrong roles, decade-old groups — makes the model produce confident nonsense, and unowned service accounts are worse. Budget identity hygiene before deployment; it’s not the vendor’s fault and helps regardless.
The honest timeline: weeks before you should trust it
Behavioural models need weeks, not days, to learn normal, and alerts are noisier meanwhile. Teams that judge alert quality in week two often abandon the product or over-suppress and blind it permanently. Agree the baselining period up front, and don’t over-tune early.
The honest positioning
Gurucul UEBA fits when your threat model centres on credentials and people — insider risk, account takeover, privilege misuse. It runs on REVEAL beside Gurucul’s SIEM or a SIEM you already run, so no migration is forced. If your identity data is poor and nobody will fix it, buy something else.
The numbers behind the platform
What your Gurucul UEBA rollout looks like
Decide: platform or overlay
Decide whether UEBA runs on REVEAL or beside your existing SIEM: overlay is smaller, platform is cleaner. It changes the quote.
Clean the identity feeds
Retire active leavers, match roles to real jobs and give every service account an owner. Errors here become false alerts.
Connect sources that show people
Start with directory, VPN, endpoint and cloud-console activity. A small clean set baselines better than a large noisy one.
Baseline, then tune
Let models learn normal before acting on scores. Tune peer groups and weighting rather than muting whole alert types.
Track findings to closure
Record which high scores became real cases and which were benign. That ratio is your evidence at renewal.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We kept our SIEM and pointed Gurucul UEBA at it. The first real finding was a service account signing in from a laptop it had never touched.”
“Peer grouping is what earned trust. A trader’s data volume on a back-office account stood out in a way no threshold ever caught.”
“Six weeks of baselining felt slow to management. Agree that window in writing before the pilot, or someone calls it a failure early.”
“Glass-box scoring matters in an audit. We can show an examiner which behaviour moved a score, not just that a model said so.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the UEBA and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid — Standing × Deployment Freedom
Analyst standing against where the platform is allowed to run — the pair that decides a regulated Indian shortlist.
2025 MQ Leader — and the only Leader we sell that self-hosts.
The Convergence × Effort Map
How much of SIEM, UEBA and response share one data model, against how much of the platform you must run yourself.
One data model — SIEM, UEBA, identity and NTA.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Gurucul UEBA vs the field
The UEBA field — honest lanes. Gurucul, Securonix and Exabeam all built on behavioural analytics; Gurucul’s edge is self-hosting plus identity context. We sell all three.
| Dimension | Gurucul | Securonix | Exabeam | Microsoft Sentinel | Splunk ES |
|---|---|---|---|---|---|
| 2025 Gartner MQ | Leader — first year, after 3 as Visionary | Leader, 6 consecutive years | Leader, 6th time | Leader | Leader, 11th consecutive |
| Self-hosted / on-premises | YES — SaaS, cloud or self-hosted per Gartner | No — control plane is always their cloud | Via LogRhythm, a second platform | Cloud-only on Azure | Yes, and priced accordingly |
| Pricing axis | Per asset / per user, OR data volume / EPS | GB/day in tiered bands | GB ingested per day (2023 list) | Per GB ingested per day | Ingest or workload — the priciest here |
| Behavioural analytics | The founding capability, built 2010 | The founding capability | The founding capability | UEBA included | Available, add-on heritage |
| India data residency | Self-hosted: yours. No vendor India region found | BYO-AWS/Snowflake can hold data in India | Self-hosted via LogRhythm | Azure India regions available | Self-hosted: yours to place |
| Vendor scale | Bootstrapped boutique — no war chest | VC-backed, ~450 engineers in India | Post-merger with LogRhythm | Microsoft | Cisco-owned |
| Analyst breadth | Gartner-specific — absent from 2025 Forrester Wave | In both Gartner and Forrester | In both | In both | In both |
| The thing to plan around | Air-gap unverified; confirm the pricing axis | No air-gap at all; 120% default overage | Two platforms post-merger | Azure portal retires 31 Mar 2027 | Untuned, it is the costliest log archive there is |
| Best fit | On-premises mandates needing an analyst-recognised product | Cloud-accepting estates wanting retention solved | UEBA-led SOC, or on-prem via LogRhythm | Microsoft estates with E5 | Engineers who will build with it |
Does Gurucul UEBA fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Gurucul UEBA if…
- ✓Your threat model centres on credentials and people rather than malware
- ✓You want the behavioural layer on the SAME platform as your log data, not alongside it
- ✓Your identity data is good enough — or somebody owns making it so
- ✓You can allow weeks of baselining before judging alert quality
Choose Securonix if…
- ✓Cloud is acceptable and you want the larger vendor with a six-year Leader run
- ✓365 days of hot searchable data as standard matters to your investigations
- ✓You accept there is no air-gapped or on-premises option in any configuration
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 with E5 — first-party logs ingest free
- ✓Azure India regions answer your residency question directly
- ✓You accept cloud-only on Azure, and the portal migration by 31 Mar 2027
Choose Elastic or Wazuh if…
- ✓You need a genuine air gap and have platform engineers to operate it
- ✓You would rather trade analyst standing for deployment freedom and cost control
- ✓Wazuh’s core is free under GPLv2; Elastic self-manages at the Basic tier
Gurucul UEBA is one of 36 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Assets or gigabytes — which meter suits you?
Gurucul can meter per asset or per user as an alternative to per-gigabyte ingest. That is the comparison worth modelling, because it is the one that changes behaviour: on an ingest-priced SIEM every improvement in logging coverage raises the invoice, so teams quietly stop collecting the sources that would have caught the intrusion. Adjust both controls: the asset count you would pay licences on, and the daily log volume an ingest-billed SIEM would charge for. The point is not the exact number, since Gurucul is quote-only. It is the shape: asset counts change slowly, log volume only ever goes up. Indicative Indian-market rates.
If the saving reads zero, the ingest-priced SIEM is genuinely cheaper at your ratio and you should say so internally rather than force the comparison. And remember the precision that matters here: Gurucul offers per-asset pricing as an alternative to per-GB, not instead of it — data-volume and EPS options exist on the same list. Which axis you land on is negotiated, so make it a clause rather than an assumption.
Three ways to consume it
Gurucul UEBA is quote-only and can be bought two ways: on the REVEAL platform beside Gurucul’s SIEM, or as an overlay on a SIEM you already run. Which is cheaper depends on what you keep. What it costs you elsewhere is preparation: peer-group quality is bounded by your identity data, and the models need weeks observing normal before their output should be acted on. Neither is a product fault and both are where deployments actually fail. TechBag quotes in INR with GST.
On REVEAL
The cleanest data model
- Shares one data model with the SIEM
- Analyst moves from score to raw events without an export
- Cleanest if you are replacing a SIEM anyway
Beside your SIEM
The smaller purchase
- Keeps the SIEM you already paid for
- Gurucul cites a customer doing this on Splunk
- You inherit that SIEM's data gaps
What it needs from you
The dependency nobody prices
- Peer groups on a stale directory mean nothing
- Service accounts need owners before they need baselines
- Weeks of baselining before judging output
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every UEBA vendor
Take this into your next vendor call — including ours.
Will UEBA run on REVEAL, or alongside the SIEM we already own — and what does each do to the quote?
Is our directory clean enough for peer groups to mean anything, and who owns fixing it?
Does every service account have a named owner who can adjudicate an alert about it?
How many weeks will we allow before judging score quality, and is that written into the pilot?
Can an analyst see which behaviours moved a score, in a form we could show an auditor?
How are peer groups built, and how fast do they adjust when people change roles?
Which of our sources carry behavioural signal, and which are just volume?
Have HR and legal agreed the monitoring notice and DPDP basis before staff activity is baselined?
If data must stay in India, is that a self-hosted deployment — and is it in writing?
Has our risk function accepted a bootstrapped vendor competing with far larger ones?
Questions buyers ask
Ready to evaluate Gurucul UEBA?
Check your identity data first, agree a realistic baselining window, or get an honest Gurucul-vs-Securonix UEBA comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.