Splunk User Behavior Analytics (UBA) leverages machine learning to detect insider threats and advanced cyberattacks by establishing behavioral baselines across entities like users, applications, hosts, networks and data, and detecting anomalies. It has a scalable architecture that can handle 500 million+ events and uses unsupervised machine learning to detect threats without rules or signatures. UBA correlates anomalies to detect complex threats and improves security analyst efficiency.