Chat now with support
Chat with Support

Change Auditor Threat Detection 7.2 - User Guide

Filters

You can use alert and indicator filters to only show the users and information that is of interest to you. The Filters pane lists pre-defined filters, with the number of users associated with each in parentheses. Clicking any of these displays all the users that fall into that category. The pre-defined filters are:

•
Risky Users: All users with a user risk score greater than 0.
•
Watchlist Users: All users who are currently flagged as “Watched”. See Add a user to the watch profile.
•
Admin Users: All users who have been previously identified as an administrator through Change Auditor as a member of one of the following groups:
•
Local Administrators
•
Active Directory Administrators
•
Domain Administrators
•
Enterprise Administrators
* 
NOTE: This is supported in Change Auditor 7.0 and later.
To create a filter
1
Click the filter that you want to modify.
2
Select the desired options from the drop-down list.
3
Click OK.
If required, after creating a filter, you can save it as a favorite, by clicking Save to Favorites.

Risk Navigator

The Risk Navigator is the color bar that is displayed at the top of the pane when the Users tab is open. It provides a severity-based breakdown of the target users.

User severity calculation

The severity of the user’s aggregate risk score is determined based on a dynamic heuristic which varies based on the scores of the users and number of users scored in the environment.

•
A maximum of 5 users will be tagged as critical depending on the spread between their user scores and the scores below them.
•
A maximum of 5 users will be tagged as high.
•
A maximum of 10% of users will receive a medium severity.
•
The remainder will receive a low severity.

The user severity is displayed by the color of the user risk score. You can filter based on the user severity.

Table 3. User severity color code
Severity
Color

Critical

Red

High

Orange

Medium

Blue

Low

Green

Users Grid

At a glance you can see user details such as their photo, display or logon name, job title, department, and address.

* 
NOTE: Alerts generated from Active Roles or GPOADmin events, use the name of the account that initiated the event (rather than the associated Service Account) for the user information in the Threat Detection portal.

The grid includes the following user data:

•
Watchlist status
•
User risk score
•
Number of alerts

Additional grid functions:

•
Sort by: Use this function to sort the existing list of users by Risk Score, Name, or Number of Alerts.
•
Export: Click to export information for the current list of users to a .csv file. The file will be automatically downloaded.
•
Add All to Watchlist: Click to add all users in the current filtered view to the watchlist.
•
Search Users List: Enter the name of a user to search for, and select it from the list that is displayed matching your entry.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating