The Dtex Enterprise User Intelligence Platform brings together six foundational elements to provide insights into how users interact with data.

User Behavior Visibility

Tailored user behavior metadata for intelligent visibility.

User Behavior Visibility

Dtex’s collector records lightweight user behavior metadata from the endpoint, collecting data that tools like SIEM, DLP, CASB, and EDR solutions miss.

Privacy Compliance

Patented anonymization to protect employee privacy.

Privacy Compliance

Dtex includes patented anonymization features that strip all identifying user information from the data collected.


User Behavior Models

Complex models of known bad behavior.

User Behavior Models

Advanced user behavior models pinpoint complex threats and allow Dtex to begin producing actionable insights immediately.



Behavioral Machine Learning

Adaptive machine learning to pinpoint threats.

Behavioral Machine Learning

Dtex uses machine learning to automatically baseline normal user behavior and pinpoint suspicious anomalies or fluctuations.


Prioritized Alerts

Scored alerts that are answers, not noise.

Prioritized Alerts

Dtex uses risk scoring and alert stacking in order to produce very finely targeted, prioritizes alerts with a low rate of false positives.



Expert Analysts

Expertise and support along the way.

Expert Analysts

Dtex’s team of expert insider threat analysts and support staff help customers answer questions, investigate threats, and interpret results.



Dtex utilizes a four-step process to elevate high-risk users and potential threats.


Gaining a true understanding of what users are doing within the organization means having the right visibility. Network or IT logs can’t provide the core insights necessary to fight insider threats. This is why Dtex begins with the cornerstone of insider threat detection: the right data, which means, user-focused data from the endpoint.


By parsing this user behavior data through advanced behavioral models, Dtex is able to provide immediate time to value. These models also allow Dtex to quickly catch certain complex types of threats, like credential theft.


Dtex combines behavior models with machine learning that automatically baselines normal user behavior and detects suspicious anomalies. These machine learning models compare the user’s behavior to themselves, their peer group, the company as a whole, or any combination thereof to proactively alert on behavior that is suspicious for that particular user. These analytics allow Dtex to pinpoint threats without inundating teams with false positives.


Once the metadata has been collected and parsed through behavior models and analytics, Dtex provides the final answer: the alert. Alert stacking will group sets of alerts together and score them by severity, which means that all alerts are prioritized. What’s more, alerts are fired in near-real time, providing immediate, actionable answers.

Deployment is seamless and provides answers enterprise-wide in just hours.

Here’s how deployment of the Dtex Enterprise User Intelligence Platform works:

First Hour

The Dtex Enterprise User Intelligence Platform is installed on your network or in the cloud and deployed to your endpoints.

First Day

The Platform begins alerting your team to high risk user activity based on behavioral models and starts baselining normal employee behavior.

First Month

The Platform hones behavioral baselines using machine learning, building a stronger understanding of what normal vs. anomalous behavior looks like for each user.


Expert Dtex analysts help you with ongoing tuning, investigations, and alert triage.

Learn More About How Enterprise User Intelligence Can Help
Secure and Optimize Your Business