Your UEBA is lying to you: Why entity record quality decides everything

This blog post argues that correct creation and governance of user and host entity records is foundational to effective security analytics. It describes pitfalls of treating raw usernames as identities or relying only on identity providers, and presents Elastic Security's approach: distinguish identity-provider-backed and endpoint-observed entities, apply confidence-tiered governance, perform automatic entity resolution across identity systems, and exclude common service/shared accounts to reduce noisy baselines and improve analyst outcomes.