Chat now with support
Chat with Support

Change Auditor Threat Detection 7.0.1 - User Guide

Threat Detection process

1
Threat Detection process includes the following steps:Events are sent to the Threat Detection server to be processed and analyzed.
2
Machine learning and user behavior analytics analyze user actions in the stream of events and builds a multi-dimensional baseline of typical behavior for each user in the environment.
3
Once the baselines are established, predefined threat indicators are used to detect anomalous user activity in real time.
4
SMART technology provides prioritized alerts that reflect a meaningful deviation in user behavior.
5
A risk score is assigned to each alert to identify the level of threat they pose to your environment.
6
Users with the highest risk scores are highlighted in the Threat Detection dashboard, creating a dynamic watch list of emerging user threats sorted by severity.

 

 

 

 

Using the Threat Detection Dashboard

•
Deployment and installation
•
Accessing the dashboard
•
Overview tab
•
Users tab
•
Alerts tab
•
How to perform an alert investigation
•
How to perform an alert investigation

Deployment and installation

For detailed instructions on how to deploy and properly install Threat Detection, see the Change Auditor for Threat Detection Deployment Guide.

For information about Change Auditor system requirements, see the Change Auditor Release Notes and the Change Auditor for Threat Detection Deployment Guide.

Accessing the dashboard

Once you have deployed the Threat Detection server, configured Change Auditor for Threat Detection, and the system has analyzed 30 days of historical data to create a baseline of user behavior, you can access the Threat Detection dashboard.

To access the dashboard from Change Auditor
•
Select View | Threat Detection Dashboard.
* 
NOTE: To access the dashboard, users must be a member of the Change Auditor Administrators/Operators group in the same domain as the coordinator used during installation.
To access the dashboard through a browser
1
Use the DNS name for the Threat Detection server provided during deployment. For example: “https://TDServerName.DomainName.Com/caui-webapp/index.html”.
2
Enter the username “catduser” and the integration password specified during the Threat Detection server deployment.
* 
NOTE: The dashboard is supported on Chrome version 56 and above.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating