Chat now with support
Chat with Support

Change Auditor Threat Detection 7.1.1 - User Guide

Alerts Tab

The Alerts tab displays detailed information about all the SMART Alerts found by the system. The Alert List at the top of the central pane displays the number of alerts for each severity level, corresponding to the Alert Filter settings in the left pane.

Alert severity calculation

The severity of the alert is based on the alert score. To see the alert score, hover over the alert severity icon.

•
Critical severity has a score of 98 – 100.
•
High severity has a score of 93 – 97.
•
Medium severity has a score of 85 – 93.
•
Low severity has a score of 75 – 84.

Alerts that do not meet the minimum threshold of 75 are discarded as false positives.

•
Alert List
•
Alert Filter

Alert List

The central pane displays the following information for each alert:

•
Severity Icon: An icon next to the alert name that indicates the severity level of the alert. Hover over the icon to see the alert score.
•
Alert Name: The name of the alert.
•
Entity Name: The name of the entity (for example, user account) that generated the alert.
•
Start Time: The date and time when this alert was first detected.
•
# Indicators: The number of unique threat indicators associated with the alert.
•
Status: Indicates if the alert has been marked as Unreviewed or Reviewed.
•
Feedback: Displays as either "No Feedback" "Actual Risk" or "Not a Risk".

Click the arrow by each alert to display the following additional details:

•
Indicator Name: The name of each unique indicator that is associated with the alert.
•
Anomaly Value: The value determined to be abnormal when compared to the baseline. This could be a number, timestamp, or text value. For example, if a user opens the same file numerous times in the same hourly timeframe, it will only display as 1 in the anomaly value.
•
Data Source: The data source (authentication, file, or Active Directory) of the risky activity.
•
Start Time; The date and time when this indicator was first detected.
•
# Events: The number of events in the indicator.

You can export the alert that is currently displayed in the central pane by clicking Export.

Alert Filter

Use the Alert Filter pane to display a subset of alerts. The following is a list of the filter categories and values:

•
Severity: Filter the list to include alerts for one or more severity level, including Critical, High, Medium, or Low.
•
Feedback: Filter the list to include alerts for one or more feedback type, including Select All, No Feedback, Actual Risk, or Not a Risk. See Alert List for information on providing feedback.
•
Entity: Filter the list to include only alerts for a specific username.
•
Indicators: Filter the list to include alerts for one or more indicators (For example, Active Directory - Abnormal Logon Time, Authentication - Logged onto Multiple Computers, Multiple File Access Failures, and so on.)
•
Date Range: Filter the list to include alerts created during a specific date range, including the Last Week, Last Month, or during a specified range.

The filters are automatically applied as you make your selections. You can clear all currently set filters by clicking Clear.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating