Security Analytics Engine 1.0


	NOTE: In cases where overrides have been disabled for a risk policy, the threat level will always be reported regardless of whether or not there is an override in place for the user.

Adding a policy override

When a user has failed to authenticate due to a high threat level, you can create an override to allow that user access for a specified period of time.


	IMPORTANT: To avoid allowing a malicious user access to applications, only create an override when you are positive the user is legitimate.

To add a policy override:

From the Home page, click Auditing. By default, the audit events for the current date are displayed.

Select the audit event you want to override and click the Details button on the bottom left of the page (see Filtering the audit events for information on locating a specific event and/or an event from a previous date).

From the Details panel, click the Override button in the lower right corner. The Add Override dialog appears.

The name of the user appears in the User Name field. Verify that this is the correct user for the override.


	NOTE: This field cannot be edited.

For Browser ID, select the browser ID that corresponds to the selected audit event or select Any to allow any browser.

In the User Address field, select the IP address that corresponds to the selected audit event or select Any to allow any IP address.

In the Expiration field, click the

button to select an expiration date for the override. By default, the next day is selected.

Click the Save button to save the override and close the dialog. The override is now in effect for the user until the specified expiration date.

Managing a policy override

To edit a policy override:

From the Home page, click Auditing. By default, the audit events for the current date are displayed.

Select an audit event from the list that is associated with a current override and click the Details button on the bottom left of the page (see Filtering the audit events for information on locating a specific event and/or an event from a previous date).

From the Details panel, click the Override button in the lower right corner. The Modify Override dialog appears.

The following information is displayed for the override:

•

Last Updated By: <nn> - The username of the administrator or help desk operator that last created or modified the override.


	NOTE: This field cannot be edited.

•

User Name - The name of the user to whom the override applies.


	NOTE: This field cannot be edited.

•

Browser ID - The Browser ID to which the override applies.

•

User Address - The IP address to which the override applies.

•

In the Expiration field, click the

button to select an expiration date for the override.

Make any necessary changes to the override.

Click the Save button to save the changes to the override and close the dialog. The changes to the override are now in effect for the user until the specified expiration date.

To delete a policy override:

From the Home page, click Auditing. By default, the audit events for the current date are displayed.

From the Details panel, click the Override button in the lower right corner. The Modify Override dialog appears.

Click the Delete button to delete the policy override.

A confirmation dialog will appear. Click the Delete button.

Policy Overrides

•

Introduction

•

Policy Overrides page

•

Adding and managing overrides on the Policy Overrides page

Introduction

From the Home page of the Administration web site, click on the Policy Overrides link to open the Policy Overrides page where you can view and manage all policy overrides that are currently in effect.