IronSphere zUEBA is a product to monitor and alert User and Entity Behavior. The agent collect calls to the ESM and report them to the IronSphere zUEBA server. The server record normal user behavior during the learning period and analyze user behavior based on his normal behavior and the ESM definitions.