Change Auditor 7.5 - User Guide

Threat Detection server events

Threat Detection server activity is also monitored. Events are generated when:

•

A risky user is identified.

•

Risky user severity is increased or decreased.

•

An alert is generated.

•

An alert is marked as a risk.

•

An alert is marked as not a risk.

To view Threat Detection events in the Change Auditor client:

•

Open the Audit Events page on the Administration Tasks tab | Auditing

The events are listed under the Threat Detection - Risky User" facility and the "Threat Detection - Alert" facility.

The event details pane contains information to help gain a better understanding of the activities taking place on the Threat Detection server including:

▪

The number of alerts and their name, severity, score.

▪

User risk score, severity, old and new severity.

▪

When the Threat Detection server started processing the alert.

▪

Indicator s associated with the alert.

▪

Contribution to user score .

For more information on the details displayed for these events, see the Change Auditor Event Reference guide.

Threat detection concepts

Threat detection concepts

The following section describes the terms and concepts used within Change Auditor Threat Detection to help you understand how risk is assessed and alerts are determined.

•

Baselines

•

Threat indicators

•

SMART alerts

•

Risk scoring

Baselines

Baselines

Change Auditor Threat Detection applies machine learning to build behavioral features and a multi-dimensional baseline of typical behavior for each user in your environment. The baseline comprises a unique set of identifiers to ensure that only abnormal behaviors are flagged. For example, the baseline can include information about when a user typically logs on, which workstation they use, whether they tend to log on from remote locations, which files they typically access and so on.

As the baselines are refined over time, the Threat Detection server makes logical assumptions around what to expect, which minimizes the chances for any alarms around normal changes in activity. Change Auditor Threat Detection requires 30 days of audit history to establish the initial user behavior baselines.

Threat indicators

Threat indicators

Indicators define risky activity, such as suspicious user logons, brute-force password attacks, unusual Active Directory changes, and abnormal file access. However, threat indicators are not constrained to a specific raw event — they use machine learning to identify patterns of events that together could indicate a threat.

Specifically, as raw events stream in, the Threat Detection server analyzes human actors, accounts, locations and operations to identify behavior that deviates from established baselines.

Abnormal and risky behaviors are evaluated to produce threat indicators. These indicators are based on present and historical patterns, as well as specifically defined risky object attributes. An indicator consolidates all activities that are detected as abnormal.

Anomalous behavior that corresponds with a threat indicator is identified based on the event’s rarity and criticality. This strategy ensures that only behavioral changes that are important and potentially indicative of a suspicious activity are highlighted out of the raw events.

Threat indicators are the basis for the formation of alerts. Sorted by severity to reflect the security importance, alerts are managed by the analyst providing investigation and feedback.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.5 - User Guide

Threat Detection server events

Threat Detection server events

To view Threat Detection events in the Change Auditor client:

Threat detection concepts

Threat detection concepts

Baselines

Baselines

Threat indicators

Threat indicators