Each employee is still a point in a 3-axis behavioral feature space: after-hours access frequency, data-egress volume, and distinct systems touched per day. But instead of orbiting a 3D point cloud, this radar plots the derived detection statistic itself — not the raw features. Radius is the live smoothed risk z-score; angle is fixed per employee, grouped into one 90°-wide sector per department (Engineering / Finance / Sales / IT Admin) so peer-group structure reads instantly.
z_i = sqrt( Σ_k ((x_i,k − μ_group,k) / σ_group,k)² )
The raw z is smoothed with an exponential moving average (time-constant ~1.2s), exactly as a real detector debounces flapping signals:
risk(t) = risk(t−dt) + (z(t) − risk(t−dt)) · (1 − e^(−dt/τ))
Concentric rings mark z = 1…6; the dashed ring is the current alert threshold. An employee's dot crossing outward past that ring — and turning red — is a live alert exactly as it would fire in a SOC.
- Time speed — scales how fast the underlying telemetry random-walks.
- Anomaly threshold — the z-score above which an entity is flagged red and logged to the alert feed; also redraws the dashed threshold ring.
- Peer-group cohesion — a tighter baseline (higher cohesion) shrinks σ, so the same raw deviation now standardizes to a larger z and pushes the dot further out — more anomalous, more sensitive detection. (Corrected here: the original 3D engine's z-score computation accidentally multiplied σ by cohesion instead of dividing, making higher cohesion less sensitive — the opposite of its own stated design and its shrinking-ellipsoid visual. This 2D version divides σ by cohesion so behavior matches the documented intent.)
- Inject Insider Drift — pushes one random employee's true telemetry sharply outside their peer baseline (a mass data pull plus off-hours logins), the way a real insider-threat or compromised-account event would, so you can watch their dot fly outward and cross the alert ring in real time.
- Hover a dot to inspect that employee's raw feature values and live risk score.
Real UEBA platforms (Splunk UBA, Exabeam, Microsoft Sentinel UEBA) run this same baseline-and-deviation logic across dozens of behavioral signals per identity, feeding the aggregated risk score into SOC alerting and automated response.