Reporting Anomalous Activity
The ControlPoint Sentinel Report lets you view anomalous activity events for which an Alert has been specified on the Sentinel Setup - Anomalous Activity Rules page. You can also filter results by user and/or date range.
To report anomalous activity:
1From the Manage ControlPoint tree choose ControlPoint Sentinel > Sentinel Report.
2If you want to narrow your results, enter one or more user(s) in the People Picker and/or enter a date range.
NOTE: If you leave the From and To Dates blank, all available results will be returned.
The tiles at the top of the report highlight the following statistics:
·The Total Number of Anomalous Activities Detected
·The number of High Risk Events as characterized by ControlPoint Sentinel
·The Number of Users with anomalous activity
·The Security Risk Score (which is derived by the Severity of each activity within the date range covered by the report)
For each anomalous event detected, report detail displays:
·the Event Time (that is, the date and the time when the ControlPoint Anomalous Activity Detection Job captured the event)
·the User whose activity triggered the anomalous activity detection alert
·the Event Severity (as defined on the Sentinel Setup - Anomalous Activity Limits page)
·the Triggering Activity Level that resulted in the anomalous activity detection alert:
§for Default daily activity, activity above the specified limit for the Event Severity
§for Personal daily activity, the amount of activity for the Event Severity to which the specified deviations above from the user's "typical" usage pattern have been applied.
·the Expected Activity Level:
§for Default daily activity, the specified limit for the Event Severity
§for Personal daily activity, "typical" usage pattern as calculated by ControlPoint Sentinel
·the Delta Activity Level (that is, the difference between Triggering Activity Level and the Expected Activity Level).
To view detailed audit log data for a user:
Click the User link to generate a ControlPoint Audit Log analysis.
Default Menu Options for ControlPoint Users
The following tables identify ControlPoint default menu items at all levels of the SharePoint Hierarchy as well as the Manage ControlPoint panel.
The following terms are used to describe menu item behavior in a Multi-farm installation:
·Home Only - The operation can be performed on the home farm only.
·Home or Remote - The operation can be performed on a single farm; either home or remote
·Multiple - The operation can be performed on multiple farms.
·Farm-Independent - The operation is not farm-specific.
Farm-Level Default Menu Items
|
Farm-Level Item |
Type |
Multi-Farm | |
|---|---|---|---|
|
Central Administration Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote | |
|
Advanced Search |
Search |
Home or Remote | |
|
SharePoint Summary Not available to members of the Business Administrators group. |
Analysis |
Home only | |
|
Refresh SharePoint Hierarchy |
Action |
Home or Remote | |
|
Properties |
Action |
Home or Remote | |
|
Run Saved Instructions Not available to members of the Business Administrators group. |
Action |
Home only | |
|
Farm Summary Dashboard Available for SharePoint 2013 and later Standard installations. |
Action |
Home only | |
|
GDPR Dashboard |
Action |
Home only | |
|
Activity folder: | |||
|
Most/Least Activity |
Analysis |
Home only | |
|
Site Collection Activity Analysis |
Analysis |
Multiple | |
|
Site Activity Analysis |
Analysis |
Multiple | |
|
Trend Analysis for Activity |
Analysis |
Home only | |
|
Activity by Profile Property Available for SharePoint Server farms. |
Analysis |
Home only | |
|
Activity by User |
Analysis |
Multiple | |
|
Activity by Document |
Analysis |
Multiple | |
|
Checked Out Documents |
Analysis |
Multiple | |
|
Blog Post Activity |
Analysis |
Home only | |
|
Inactive Users |
Analysis |
Home only | |
|
Social Activity Analysis Available for SharePoint Server 2010 farms. |
Analysis |
Home only | |
|
Audit and Alerts folder: | |||
|
Manage Audit Settings |
Action |
Multiple | |
|
ControlPoint Alerts |
Action |
Home only | |
|
Create SharePoint Alerts |
Action |
Home only | |
|
Manage SharePoint Alerts |
Action |
Home only | |
|
Audit Log Analysis |
Analysis |
Multiple | |
|
Change Log Analysis |
Analysis |
Multiple | |
|
SharePoint Alerts by Site |
Analysis |
Multiple | |
|
SharePoint Alerts by User |
Analysis |
Multiple | |
|
Automation folder: | |||
|
Create ControlPoint Policy |
Action |
Home only | |
|
Manage ControlPoint Policies |
Action |
Home only | |
|
Governance Policy Manager Not available to members of the Business Administrators group. |
Action |
Home only | |
|
Set Metadata Value Not available for Foundation farms. |
Action |
Home only | |
|
Create Managed Metadata Not available for Foundation farms. |
Action |
Home only | |
|
Manage SharePoint Groups |
Action |
Home or Remote | |
|
ControlPoint Policies |
Analysis |
Home only | |
|
Change Management folder: | |||
|
Content Types |
Analysis |
Multiple | |
|
Web Parts by Part |
Analysis |
Multiple | |
|
Web Parts by Site |
Analysis |
Multiple | |
|
Workflow Analysis |
Analysis |
Multiple | |
|
Compliance folder: Available to members of the Compliance Administrators group. | |||
|
Analyze Content |
Action |
Home only | |
|
Manage Scanned Files |
Action |
Home Only | |
|
Managing Quarantine Documents Available to members of the Quarantine Administrators group. |
Action |
Home only | |
|
Compliance Summary |
Analysis |
Home only | |
|
Sensitive Content Activity |
Analysis |
Home only | |
|
Scanned files by Scope |
Analysis |
Home only | |
|
Scanned files by Search terms |
Analysis |
Home only | |
|
Configuration folder: | |||
|
Set Site Collection Properties |
Action |
Multiple | |
|
Set Site Properties |
Action |
Multiple | |
|
Set List Properties |
Action |
Multiple | |
|
Manage Site Collection Features |
Action |
Multiple | |
|
Manage Site Features |
Action |
Multiple | |
|
SharePoint Hierarchy |
Analysis |
Multiple | |
|
Site Collection Properties |
Analysis |
Home Only | |
|
Site Properties |
Analysis |
Home Only | |
|
List Properties |
Analysis |
Multiple | |
|
Content folder: | |||
|
Managed Metadata Usage Not available for Foundation farms. |
Analysis |
Multiple | |
|
Trend Analysis for Site Count |
Analysis |
Home only | |
|
Broken Links |
Analysis |
Multiple | |
|
Solution Summary Not available to members of the Business Administrators group. |
Analysis |
Multiple | |
|
Storage folder: | |||
|
Most/Least Storage |
Analysis |
Home Only | |
|
Site Collection Storage Analysis |
Analysis |
Multiple | |
|
Site Storage Analysis |
Analysis |
Multiple | |
|
Content Database Storage |
Analysis |
Multiple | |
|
Trend Analysis for Storage |
Analysis |
Home only | |
|
Duplicate Files |
Analysis |
Home only | |
|
Storage by File Type |
Analysis |
Home only | |
|
Recycle Bins |
Analysis |
Multiple | |
|
Users and Security folder: | |||
|
Set User Direct Permissions |
Action |
Multiple | |
|
Delete User Permissions |
Action |
Multiple | |
|
Duplicate User Permissions |
Action |
Multiple | |
|
Add User to SharePoint Group |
Action |
Home or Remote | |
|
Delete SharePoint Groups |
Action |
Home only | |
|
Backup Permissions |
Action |
Home only | |
|
Manage Permissions Backups |
Action |
Home only | |
|
Manage Permissions Inheritance |
Action |
Multiple | |
|
Migrate Users |
Action |
Home or Remote | |
|
Orphaned Domain Users |
Analysis |
Multiple | |
|
Site Permission |
Analysis |
Multiple | |
|
Comprehensive Permissions |
Analysis |
Multiple | |
|
Comprehensive User Analysis |
Analysis |
Home only | |
|
SharePoint Group Analysis |
Analysis |
Multiple | |
Web Application-Level Default Menu Items
|
Web Application-Level Item |
Type |
Multi-Farm |
|---|---|---|
|
Advanced Search |
Search |
Home or Remote |
|
Add to Selection |
Action |
(Depends on operation) |
|
Properties |
Action |
Home or Remote |
|
Activity folder: | ||
|
Most/Least Activity |
Analysis |
Home Only |
|
Site Collection Activity Analysis |
Analysis |
Multiple |
|
Site Activity Analysis |
Analysis |
Multiple |
|
Trend Analysis for Activity |
Analysis |
Home Only |
|
Activity by Profile Property Not available for Foundation farms. |
Analysis |
Home Only |
|
Activity by User |
Analysis |
Multiple |
|
Activity by Document |
Analysis |
Multiple |
|
Checked Out Documents |
Analysis |
Multiple |
|
Inactive Users |
Analysis |
Multiple |
|
Blog Post Activity |
Analysis |
Home Only |
|
Social Activity Analysis |
Analysis |
Home Only |
|
Audit and Alerts folder: | ||
|
Manage Audit Settings |
Action |
Multiple |
|
ControlPoint Alerts |
Action |
Home Only |
|
Create SharePoint Alerts |
Action |
Home Only |
|
Manage SharePoint Alerts |
Action |
Home Only |
|
Audit Log Analysis |
Analysis |
Multiple |
|
Change Log Analysis |
Analysis |
Multiple |
|
SharePoint Alerts by Site |
Analysis |
Multiple |
|
SharePoint Alerts by User |
Analysis |
Multiple |
|
Automation folder: | ||
|
Create ControlPoint Policy |
Action |
Home Only |
|
Manage ControlPoint Policies |
Action |
Home Only |
|
Set Metadata Value Not available for Foundation farms. |
Action |
Home Only |
|
Create Managed Metadata Not available for Foundation farms. |
Action |
Home Only |
|
Manage SharePoint Groups |
Action |
Home or Remote |
|
ControlPoint Policies |
Analysis |
Home Only |
|
Change Management folder: | ||
|
Content Types |
Analysis |
Multiple |
|
Web Parts by Part |
Analysis |
Multiple |
|
Web Parts by Site |
Analysis |
Multiple |
|
Workflow Analysis Not available to members of the Business Administrators group. |
Analysis |
Multiple |
|
Compliance folder: Available to members of the Compliance Administrators group. | ||
|
Analyze Content |
Action |
Home Only |
|
Manage Scanned Files |
Action |
Home Only |
|
Managing Quarantine Documents Available to members of the Quarantine Administrators group. |
Action |
Home Only |
|
Compliance Summary |
Analysis |
Home Only |
|
Sensitive Content Activity |
Analysis |
Home Only |
|
Scanned files by Scope |
Analysis |
Home Only |
|
Scanned files by Search terms | ||
|
Scanned files by Search terms |
Action |
Multiple |
|
Set Site Properties |
Action |
Multiple |
|
Set List Properties |
Action |
Multiple |
|
Manage Site Collection Features |
Action |
Multiple |
|
Manage Site Features |
Action |
Multiple |
|
Alternate Access Mappings Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Configure Document Conversions Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Define Managed Paths Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Delete Web Application Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Extend Web Application to Another IIS Website Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Information Management Policy Usage Reports Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Manage Content Databases Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Manage Web Application Features Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Remove SharePoint from IIS Web Site Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Web Application General Settings Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Web Application Outgoing E-Mail Settings Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
SharePoint Hierarchy |
Analysis |
Home Only |
|
Site Collection Properties |
Analysis |
Home Only |
|
Site Properties |
Analysis |
Multiple |
|
List Properties |
Analysis |
Multiple |
|
Content folder: | ||
|
Managed Metadata Usage Available for SharePoint Server farms. |
Analysis |
Multiple |
|
Trend Analysis for Site Count |
Analysis |
Multiple |
|
Broken Links |
Analysis |
Multiple |
|
Solution Summary Not available to members of the Business Administrators group. |
Analysis |
Multiple |
|
Site Management folder: | ||
|
Create Site Collection Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Site Use Confirmation and Deletion Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Storage folder: | ||
|
Most/Least Storage Analysis |
Analysis |
Home Only |
|
Site Collection Storage Analysis |
Analysis |
Multiple |
|
Site Storage Analysis |
Analysis |
Multiple |
|
Content Database Storage |
Analysis |
Multiple |
|
Trend Analysis for Storage |
Analysis |
Home Only |
|
Duplicate Files |
Analysis |
Home Only |
|
Storage by File Type |
Analysis |
Home Only |
|
Recycle Bins |
Analysis |
Multiple |
|
Users and Security folder: | ||
|
Set User Direct Permissions |
Action |
Multiple |
|
Delete User Permissions |
Action |
Multiple |
|
Duplicate User Permissions |
Action |
Multiple |
|
Add User to SharePoint Group |
Action |
Home or Remote |
|
Delete SharePoint Groups |
Action |
Home Only |
|
Backup Permissions |
Action |
Home Only |
|
Manage Permissions Backups |
Action |
Home Only |
|
Manage Permissions Inheritance |
Action |
Multiple |
|
Authentication Providers Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Policy for Web Application Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Self-Service Site Management Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Security for Web Part Pages Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
User Permissions for Web Applications Not available to members of the Business Administrators group. |
SharePoint |
Home or Remote |
|
Orphaned Domain Users |
Analysis |
Multiple |
|
Site Permissions |
Analysis |
Multiple |
|
Comprehensive Permissions |
Analysis |
Multiple |
|
Comprehensive User Analysis |
Analysis |
Home Only |
|
SharePoint Group Analysis |
Analysis |
Multiple |