Security Analytics Engine 1.1

A risk policy that an application selects to use for evaluation will most likely be similar to the risk policy used in the Sample Application provided by default with the Security Analytics Engine (for more information, see Sample Application). It consists of all the conditions that you want checked during an access attempt and those conditions will operate together to create a single risk score which the application will then use to determine whether to allow an access attempt, request additional authentication information from the user, or deny access. Alerts can be configured for the risk policy providing the evaluation in which case they will issue an alert when the generated risk score exceeds the configured threshold.

A risk policy designed for alerting will in its simplest form consist of a single condition without modifiers. When an access attempt occurs, all risk policies with alerting enabled that are associated with the application will send alerts. Due to the method used for calculating risk scores, an alert sent with information about a single triggered condition will not always be the same as the amount it contributed to the risk score during the access attempt.

Applications page

The Applications page is displayed when Applications is clicked on the Home page of the Security Analytics Engine Administration web site. From this page you can launch the Application wizard to add new or edit existing applications, and create and manage the risk policies being used by applications.

The Applications page displays all of the applications currently using the Security Analytics Engine and the risk policies used by each application.

The following buttons and field appear across the top of the page:

This button is used for adding a new application.

This button is used for editing an existing application.

This button is used for deleting an existing application.

The following information is displayed for each configured application:

Application Name

Displays the name assigned to the application when it was created.

Description

Displays the description of the application. This description was added when the application was created.

Policies

Displays the risk policies currently available for use by the application. To distinguish between shared risk policies and risk policies, shared risk policies are marked as ‘(shared)’. It is the responsibility of the client application to determine which risk policy to evaluate during access attempts.

Sample Application

A sample application (Sample Application) and risk policy (Sample) are added upon installation of the Security Analytics Engine. These function as both an example of how to configure your own applications and a starting point as you begin to create risk policies. For that reason, the sample application can be reconfigured to direct to an actual application and the sample risk policy edited to fit this new application.

The following settings are used in the Sample Application and Sample risk policy:

Table 25. Sample Application settings
Field	Setting
Application Name
Application Description	This is a sample application.
Client API ID	Demo Client
Client API Secret	<nn> (A 34-character secret)
Policies	Sample