- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Gurucul UEBA
A stolen credential does nothing malformed — Gurucul UEBA baselines every user and entity and scores the deviation, which is the only way to catch an attacker who logs in correctly and does permitted things. It is the capability the company was founded on in 2010, not one it acquired.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Where data lives
Yours, if you self-host
Gartner’s own 2025 MQ text confirms the platform runs SaaS, cloud OR self-hosted. Self-hosted puts collection scope and physical storage under your control — on-premises or your own cloud account, in India if you choose — which is how you hold 180 days of logs in Indian jurisdiction and evidence it.
Two things we could NOT verify
Air-gap, and any India region
A genuine air gap is marketed but we could not confirm it independently, and self-hosted is not the same thing — air-gap affects licence activation, threat-intel updates and support access. We also found no evidence of a vendor-run India data region. Get both in writing before you commit.
Check which obligation genuinely binds you; the hard-line reading is oversold constantly, on-premises platform vendors among the culprits — so treat our incentive with the same caution. CERT-In’s Directions of April 2022 set a rolling 180-day retention on ICT logs, to be held “within the Indian jurisdiction”, while its own FAQ of May 2022 (Q35) permits offshore storage provided the logs can be produced within a reasonable period — financial-transaction records carry the hard in-India duty. It is the sector regulator that removes the doubt: IRDAI’s 2023 audit annexure asks insurers a yes/no question on whether ICT infrastructure logs are held in India, and they must be able to answer yes. If that is you, self-hosting stops being a preference. Bear in mind that India-based people and India-stored data are not the same — Pune has a real engineering centre, which is no data region.
Quick answer
The Gurucul platform family
This page covers Gurucul UEBA — the behavioural analytics. The other pillars:
Quick facts
30-second orientation- Product
- Gurucul UEBA — on the REVEAL platform
- Vendor
- Gurucul — founder-CEO Saryu Nayyar, still in post
- Heritage
- The founding capability, built 2010 — not acquired
- Sold as
- Its own product — on REVEAL or beside your SIEM
- What it catches
- Stolen credentials and insider misuse — attacks that break no rule
- Deployment
- Follows the platform: SaaS, cloud or self-hosted
- Hard dependency
- Identity-data quality — stale directory, worthless peer groups
- Time to trust
- Weeks of baselining before output should be acted on
- Data residency
- Yours if self-hosted; no vendor India region found
- Data processing
- Same platform as the SIEM — one data model, no second copy
- Buy in India via
- TechBag — identity-readiness scoping, INR, GST
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Analytics that learn how each user and entity normally behaves and score deviation — the capability Gurucul was founded on in 2010 and grew a SIEM around.
Rules-only detection vs Gurucul UEBA — the honest table
What behavioural baselining changes about catching an attacker who logs in correctly.
| Dimension | Rule-based SIEM alone | Gurucul UEBA |
|---|---|---|
| Detection basis | Signatures and correlation rules | Per-user and peer-group baselines |
| Stolen credentials | Valid login, nothing to match | Deviation from that user’s normal scores |
| Insider misuse | Permitted access, so silent | Unusual volume, hour or resource flags it |
| Evidence | Analyst stitches events by hand | Link Chain Analysis assembles the case |
| Existing SIEM | Replace it to get analytics | Can run alongside the SIEM you keep |
| Identity context | Activity only | Activity weighed against entitlements |
| Honest caveat | — | Weeks of baselining; directory quality decides it |
| Best fit | — | Credential- and insider-led threat models |
Behavioural baselining is the edge — if your threat model is malware-led, a strong EDR may matter more (TechBag sells those too).
The six pieces behind Gurucul UEBA
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Data ingestion
Pulls identity, authentication, endpoint, network and cloud activity from REVEAL’s collectors or from a SIEM you keep. Gurucul cites a customer running its UEBA to augment Splunk.
Entity Intelligence Engine
Stitches accounts, devices and service identities into one entity, so behaviour on the VPN, the laptop and the cloud console is judged as one person’s activity.
Model library
Gurucul says it ships more than 5,000 glass-box machine-learning models. Glass-box matters: an analyst can see which behaviour moved a score, which makes a finding defensible.
Peer-group analytics
Each user is compared with their own history and with a dynamically built peer group, so a clerk pulling a trader’s data volume stands out even on day one of the pattern.
Risk scoring
Anomalies accumulate into a real-time risk score per entity, weighted by entitlements, so a dormant admin account waking up outranks a noisy but harmless laptop.
Link Chain Analysis
Gurucul’s patented Link Chain Analysis stitches related anomalies and context into a case of evidence, so the analyst reviews one chain instead of rebuilding the sequence.
Baselines per user and entity, scored against peers and entitlements — on REVEAL, or alongside the SIEM you already run.
Ten capabilities. Baseline, score, investigate.
Gurucul UEBA learns how each user, device and service account normally behaves, scores the deviation, and hands analysts the evidence chain. Here is what sits in each layer.
Identity and activity feeds
Directory, IAM, VPN, endpoint, cloud and SaaS activity feed the models — the data that shows how people actually work.
Runs beside your SIEM
Can consume data from a SIEM you already own, so behavioural detection does not wait on a migration.
Entity resolution
Accounts, devices and service identities resolved to one entity before any baseline is built.
Per-entity baselines
Learns normal hours, systems, volumes and sequences for every user, host and service account.
Dynamic peer groups
Compares each user with people doing similar work, not only with their own history.
Compromised-account detection
Flags valid logins used abnormally — dormant accounts waking, privilege jumps, unfamiliar hosts.
Insider misuse
Surfaces data staging, unusual bulk access and entitlement abuse that no rule describes.
Real-time risk scores
Anomalies accumulate per entity, weighted by what that entity is entitled to do.
Link Chain Analysis
Related anomalies assembled into one evidence chain an analyst can read and defend.
Hand-off to response
High-scoring entities can be passed to SOAR playbooks for containment — stage them before they act.
Watch Gurucul UEBA in action
The behavioural analytics demonstrated, and the platform it runs on.
REVEAL Demo: Advanced Analytics
The behavioural analytics, demonstrated.
Gurucul REVEAL — Platform Overview
Where the analytics sit.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Catch the login that breaks no rule.
Here’s what genuinely sets Gurucul UEBA apart (and where Securonix or Exabeam may fit better).
It catches the attack that breaks no rule
This is the whole argument for behavioural analytics and it is worth stating precisely. A rule only catches what somebody thought to write down in advance. An attacker with stolen credentials does nothing malformed — they sign in correctly, from a plausible location, at a plausible hour, and access what that account is entitled to access. Every step is permitted. No signature matches, no correlation rule fires, and the SIEM records it as ordinary activity. The only way to see it is to know what normal looks like for that specific user and score the deviation: this person has never touched that system, never at this volume, never at this hour, and their peer group does not either. The same logic is the only thing that catches an insider misusing access they legitimately hold, which is by definition invisible to any rule about unauthorised access.
Built first, not bolted on
Most UEBA in this market arrived by acquisition, bolted onto a SIEM that already existed — which is why so many deployments involve two consoles, two data stores and an analyst exporting from one to the other. Gurucul did it the other way round: the analytics came first in 2010 and the SIEM grew around them. The practical consequence is that a risk score and the events that produced it live on the same platform. An analyst who wants to know why a user scored 87 clicks through to the underlying activity rather than filing a request. That sounds minor and is not — the friction of switching tools is what stops analysts investigating borderline scores, which is exactly where the interesting cases sit.
Identity context, not just activity
Behavioural scoring is much stronger when it knows what a user is entitled to do, not merely what they did. Because identity analytics runs on the same platform, deviation is assessed against entitlements: this access was dormant for a year and has suddenly been used, this person accumulated permissions across three role changes and is now using all of them at once. That context is what separates a genuine finding from an anomaly that turns out to be someone doing their new job. It also means access risk and detection reason over one picture of who your users are rather than two that disagree.
The honest dependency: your directory decides the outcome
We would rather say this plainly than have you discover it in month three. Peer-group analysis compares a user against people like them, and it derives that grouping from your identity data. If your directory is stale — leavers still active, roles not reflecting actual jobs, groups that accreted over a decade — the peer groups are wrong and the model produces confident nonsense. Service accounts are the sharpest version: they behave nothing like humans, they are frequently unowned, and without a named owner nobody can adjudicate an alert about one. Budget the identity hygiene work before deployment, not after. It is unglamorous, it is not the vendor's fault, and it improves your security posture regardless of which product you eventually buy.
The honest timeline: weeks before you should trust it
Behavioural models need to observe normal before deviation means anything. That period is genuinely weeks, not days, and during it the alerts will be noisier and less useful than they will be later. The failure mode we see is a team evaluating alert quality in week two, concluding the product is poor, and either abandoning it or over-suppressing so aggressively that they blind it permanently. Agree the baselining period up front with everyone who will judge the deployment, so nobody mistakes an immature model for a bad product. And do not over-tune early — suppression added in the noisy phase tends to survive long after the reason for it has gone.
The honest positioning
Gurucul UEBA is right when your threat model genuinely centres on credentials and people — insider risk, account takeover, privilege misuse — and you want the behavioural layer on the same platform as your log data rather than alongside it. It does not force a migration: Gurucul sells it on REVEAL beside its own SIEM or alongside a SIEM you already run, so the choice is packaging rather than a platform replacement. And if your identity data is in poor shape and nobody will own fixing it, buy something else, because no UEBA product will work for you until that changes. We would rather tell you that now than sell you an outcome you cannot reach.
The numbers behind the platform
What your Gurucul UEBA rollout looks like
Decide: platform or overlay
Choose whether UEBA runs on REVEAL or beside the SIEM you keep. Overlay is the smaller purchase; platform is the cleaner data model. Decide before scoping — it changes the quote.
Clean the identity feeds
Retire leavers still active, match roles to real jobs and give every service account a named owner. Peer groups are built from this data, so errors here become false alerts later.
Connect sources that show people
Directory, VPN, endpoint and cloud-console activity first — they carry the most behavioural signal. A small clean set baselines better than a large noisy one.
Baseline, then tune
Let the models observe normal before acting on scores. Tune peer groups and entitlement weighting rather than muting whole alert types, which blinds the model long after the noise is gone.
Track findings to closure
Record which high scores became real cases and which were benign. That ratio is your evidence at renewal and shows where baselines still need work.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We kept our SIEM and pointed Gurucul UEBA at it. The first real finding was a service account signing in from a laptop it had never touched.”
“Peer grouping is what earned trust. A trader’s data volume on a back-office account stood out in a way no threshold ever caught.”
“Six weeks of baselining felt slow to management. Agree that window in writing before the pilot, or someone calls it a failure early.”
“Glass-box scoring matters in an audit. We can show an examiner which behaviour moved a score, not just that a model said so.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the UEBA and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid — Standing × Deployment Freedom
Analyst standing against where the platform is allowed to run — the pair that decides a regulated Indian shortlist.
2025 MQ Leader — and the only Leader we sell that self-hosts.
The Convergence × Effort Map
How much of SIEM, UEBA and response share one data model, against how much of the platform you must run yourself.
One data model — SIEM, UEBA, identity and NTA.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Gurucul UEBA vs the field
The UEBA field — honest lanes. Gurucul, Securonix and Exabeam all built on behavioural analytics; Gurucul’s edge is self-hosting plus identity context. We sell all three.
| Dimension | Gurucul | Securonix | Exabeam | Microsoft Sentinel | Splunk ES |
|---|---|---|---|---|---|
| 2025 Gartner MQ | Leader — first year, after 3 as Visionary | Leader, 6 consecutive years | Leader, 6th time | Leader | Leader, 11th consecutive |
| Self-hosted / on-premises | YES — SaaS, cloud or self-hosted per Gartner | No — control plane is always their cloud | Via LogRhythm, a second platform | Cloud-only on Azure | Yes, and priced accordingly |
| Pricing axis | Per asset / per user, OR data volume / EPS | GB/day in tiered bands | GB ingested per day (2023 list) | Per GB ingested per day | Ingest or workload — the priciest here |
| Behavioural analytics | The founding capability, built 2010 | The founding capability | The founding capability | UEBA included | Available, add-on heritage |
| India data residency | Self-hosted: yours. No vendor India region found | BYO-AWS/Snowflake can hold data in India | Self-hosted via LogRhythm | Azure India regions available | Self-hosted: yours to place |
| Vendor scale | Bootstrapped boutique — no war chest | VC-backed, ~450 engineers in India | Post-merger with LogRhythm | Microsoft | Cisco-owned |
| Analyst breadth | Gartner-specific — absent from 2025 Forrester Wave | In both Gartner and Forrester | In both | In both | In both |
| The thing to plan around | Air-gap unverified; confirm the pricing axis | No air-gap at all; 120% default overage | Two platforms post-merger | Azure portal retires 31 Mar 2027 | Untuned, it is the costliest log archive there is |
| Best fit | On-premises mandates needing an analyst-recognised product | Cloud-accepting estates wanting retention solved | UEBA-led SOC, or on-prem via LogRhythm | Microsoft estates with E5 | Engineers who will build with it |
Does Gurucul UEBA fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Gurucul UEBA if…
- ✓Your threat model centres on credentials and people rather than malware
- ✓You want the behavioural layer on the SAME platform as your log data, not alongside it
- ✓Your identity data is good enough — or somebody owns making it so
- ✓You can allow weeks of baselining before judging alert quality
Choose Securonix if…
- ✓Cloud is acceptable and you want the larger vendor with a six-year Leader run
- ✓365 days of hot searchable data as standard matters to your investigations
- ✓You accept there is no air-gapped or on-premises option in any configuration
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 with E5 — first-party logs ingest free
- ✓Azure India regions answer your residency question directly
- ✓You accept cloud-only on Azure, and the portal migration by 31 Mar 2027
Choose Elastic or Wazuh if…
- ✓You need a genuine air gap and have platform engineers to operate it
- ✓You would rather trade analyst standing for deployment freedom and cost control
- ✓Wazuh’s core is free under GPLv2; Elastic self-manages at the Basic tier
Gurucul UEBA is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Assets or gigabytes — which meter suits you?
Gurucul can meter per asset or per user as an alternative to per-gigabyte ingest. That is the comparison worth modelling, because it is the one that changes behaviour: on an ingest-priced SIEM every improvement in logging coverage raises the invoice, so teams quietly stop collecting the sources that would have caught the intrusion. Adjust both controls: the asset count you would pay licences on, and the daily log volume an ingest-billed SIEM would charge for. The point is not the exact number, since Gurucul is quote-only. It is the shape: asset counts change slowly, log volume only ever goes up. Indicative Indian-market rates.
If the saving reads zero, the ingest-priced SIEM is genuinely cheaper at your ratio and you should say so internally rather than force the comparison. And remember the precision that matters here: Gurucul offers per-asset pricing as an alternative to per-GB, not instead of it — data-volume and EPS options exist on the same list. Which axis you land on is negotiated, so make it a clause rather than an assumption.
Three ways to consume it
Gurucul UEBA is quote-only and can be bought two ways: on the REVEAL platform beside Gurucul’s SIEM, or as an overlay on a SIEM you already run. Which is cheaper depends on what you keep. What it costs you elsewhere is preparation: peer-group quality is bounded by your identity data, and the models need weeks observing normal before their output should be acted on. Neither is a product fault and both are where deployments actually fail. TechBag quotes in INR with GST.
On REVEAL
The cleanest data model
- Shares one data model with the SIEM
- Analyst moves from score to raw events without an export
- Cleanest if you are replacing a SIEM anyway
Beside your SIEM
The smaller purchase
- Keeps the SIEM you already paid for
- Gurucul cites a customer doing this on Splunk
- You inherit that SIEM's data gaps
What it needs from you
The dependency nobody prices
- Peer groups on a stale directory mean nothing
- Service accounts need owners before they need baselines
- Weeks of baselining before judging output
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every UEBA vendor
Take this into your next vendor call — including ours.
Will UEBA run on REVEAL, or alongside the SIEM we already own — and what does each do to the quote?
Is our directory clean enough for peer groups to mean anything, and who owns fixing it?
Does every service account have a named owner who can adjudicate an alert about it?
How many weeks will we allow before judging score quality, and is that written into the pilot?
Can an analyst see which behaviours moved a score, in a form we could show an auditor?
How are peer groups built, and how fast do they adjust when people change roles?
Which of our sources carry behavioural signal, and which are just volume?
Have HR and legal agreed the monitoring notice and DPDP basis before staff activity is baselined?
If data must stay in India, is that a self-hosted deployment — and is it in writing?
Has our risk function accepted a bootstrapped vendor competing with far larger ones?
Questions buyers ask
Ready to evaluate Gurucul UEBA?
Check your identity data first, agree a realistic baselining window, or get an honest Gurucul-vs-Securonix UEBA comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.