SURVEILLANCE SYSTEM / CAPABILITY

User Activity Monitoring (UAM)

UAM is the technical capability to observe and record an individual’s activity on systems in order to detect insider threats and support authorized investigations. Commercial workplace-monitoring systems can implement related capabilities outside government.

NATIONWIDE / APPLIES IN IL
RUNG
workplace
STATUS
ACTIVE CAPABILITY

HOW YOU ENCOUNTER IT

Where the surveillance relationship begins

Using an employer-managed computer, account, network, or other monitored work system.

DATA

What it can collect or process

  • Login/activity events
  • Application and resource access
  • File or network activity
  • Other endpoint telemetry depending on implementation

DATA FLOW

What happens to the information

  1. 1Endpoint/account activity is recorded
  2. 2Events are centralized or correlated
  3. 3Rules or behavioral analytics identify activity for review
  4. 4Analysts, security teams, or managers may act on resulting alerts

RELATED ENTITIES

Operators, vendors, programs, and platforms

UAM / UEBA systemsplatform

SOURCES

Receipts