User profile definition and management

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code for generating a user behavior profile, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• monitoring electronically-observable user behavior about a particular entity;
• maintaining a state about the particular entity, the state representing a context of a particular event;
• converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;
• generating a user behavior profile based upon the electronic information representing the electronically-observable user behavior, the user behavior profile comprising a collection of information that describes the particular entity, the collection of information comprising at least one of a user profile attribute, a user behavior factor and a user mindset factor;
• generating a collection of information reflecting an inferred state of a user at a particular time, the collection of information reflecting the inferred state of the user at the particular time representing aspects of the particular entity that are inferred based upon the electronically-observable user behavior;
• performing a security analysis operation via a security analytics system, the security analysis operation analyzing the event using the state of the entity, the collection of information reflecting the inferred state of the user at the particular time and the user behavior profile, the analyzing determining whether the electronically-observable user behavior about the particular entity does not correspond to known good behavior, the security analysis operation determining that the particular entity represents a security threat to an organization associated with the security analytics system when the electronically-observable user behavior about the particular entity does not correspond to known good behavior;
• and,
• performing an enforcement operation when the electronically-observable user behavior about the particular entity does not correspond to known good behavior.