Chat now with support
Chat with Support

Change Auditor Threat Detection 7.0.1 - User Guide

Risk Navigator

The Risk Navigator provides a severity-based breakdown of the target users. Use this Navigator to filter out users with the specific risk score - Critical, High, Medium or Low.

Users Grid

The grid includes the following user data:

•
Username
•
Watchlist status
•
Risk score
•
Number of alerts

Additional grid functions:

•
Sort by: Use this function to sort the existing list of users by Risk Score, Name, or number of Alerts.
•
Export: Click to export information for the current list of users to a .csv file. The file will be automatically downloaded.
•
Add All to Watchlist: Click to add all users in the current filtered view to the watchlist.
•
Search Users List: Enter the name of a user to search for, and select it from the list that is displayed matching your entry.

Alerts tab

The Alerts tab displays detailed information about all the SMART Alerts found by the system. The Alert List at the top of the central pane displays the number of alerts for each severity level, corresponding to the Alert Filter settings in the left pane.

•
Alert list
•
Alert Filter

Alert list

The central pane displays the following information for each alert:

•
Severity Icon – An icon next to the alert name that indicates the severity level of the alert.
•
Alert Name – The name of the alert.
•
Entity Name – The name of the entity (for example, user account) that generated the alert.
•
Start Time – The date and time when this alert was first detected.
•
# Indicators – The number of unique threat indicators associated with the alert.
•
Status – Indicates if the alert has been marked as “Unreviewed”, “Actual Risk”, or “Not A Risk”.
•
Feedback – Indicates whether any analysts comments have been applied for the alert.

Click the arrow by each alert to display the following additional details:

•
Indicator Name – The name of each unique indicator that is associated with the alert.
•
Anomaly Value – The value determined to be abnormal when compared to the baseline. This could be a number, timestamp, or text value. This value is the number of distinct events that occurred in an hourly timeframe. For example, if a user opens the same file numerous times in the same hourly timeframe, it will only display as 1 in the anomaly value.
•
Data Source – The type of data where the indicator was found.
•
Start Time – The date and time when this indicator was first detected.
•
# Events – The number of events in the indicator.

You can export the alert that is currently displayed in the central pane by clicking Export.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating