Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Security Analytics Engine 1.1 - User Guide

Table of Contents

Security Analytics Engine Overview

Introduction Launch the Security Analytics Engine Administration web site Web site components

Heading bar Main web pages Navigating the Security Analytics Engine Administration web site Filter data

Introduction Plugins page Plugins

BlacklistProviderPlugin BuiltinPlugin GeoLocationPlugin LdapPlugin SonicWALLPlugin

Editing plugins

Introduction Conditions page Condition categories

Abnormal Browser

Abnormal Authentication Abnormal Time Associated w/ Application Category Associated w/ Application Threat Level Associated w/ Blacklist Associated w/ Country Associated w/ Malware Authentication List

Abnormal Location Country List

Dynamic Blacklist Network List

Role List Last Logon LDAP Group

Adding and managing conditions

Creating a new condition Managing conditions

Shared Policies

Introduction Shared risk policies Shared Policies page Adding and managing shared risk policies

Adding a new shared risk policy Managing shared risk policies

Shared Policy wizard

Introduction Risk policies Applications page

Sample Application

Adding and managing applications

Adding a new application Managing applications

Adding and managing risk policies

Adding a new risk policy Managing risk policies Managing shared risk policies in an application

Application wizard

Introduction Auditing page

Filtering options Retention settings option Audit Events table Event details Download options

Filtering the audit events Configuring the retention settings Displaying details for an individual audit event Downloading audit events information Adding and managing overrides on the Auditing page

Adding a policy override Managing a policy override

Introduction Issued Alerts page

Filtering options Issued Alerts table

Filtering the issued alerts

Policy Overrides

Introduction Policy Overrides page Managing overrides on the Policy Overrides page

Fallback Password

Introduction Fallback Administrator Password page

Security Settings

Introduction Security wizard

Adding new authentication providers

Security wizard pages

Issued Alerts page

The Issued Alerts page is displayed when Issued Alerts is clicked on the Reports page of the Security Analytics Engine Administration web site.

The Issued Alerts page displays a list of the alerts sent by the Security Analytics Engine. These results are filtered using the options located at the top of the page.

Filtering options

The following are the filtering options at the top of the Issued Alerts page:


	NOTE: Refreshing the screen returns the Issued Alerts page to its default settings.


	NOTE: Issued alerts follow the same retention settings as audit events.

This field specifies the date to start searching for alerts. By default, this is the current date. Click anywhere in the field to display a calendar from which to select a date to start searching for alerts. You can also manually edit the date in the field (mm/dd/yyyy).

This field specifies a date to stop searching for alerts. By default, this is the current date. Click anywhere in the field to display a calendar from which to select a date to stop searching for alerts. You can also manually edit the date in the field (mm/dd/yyyy).

This drop-down list displays the currently configured applications. Select to display issued alert information for all applications or a specific application. By default, issued alerts for all applications are displayed.

This field is used for setting the maximum number of records (1-10000) to return for the search. By default, this is 1000 records.

The Search button updates the Issued Alerts table located beneath the filtering options.

For more information on using the above filtering options, see To filter issued alerts. For information on filtering individual columns, see To filter data.

Issued Alerts table

The following information is displayed for each alert in the Issued Alerts table.

This column displays the date and time the alert was issued.

This column displays the name of the application.

This column displays the name of the requested resource. It appears blank when an attribute specifying the resource is not returned by the application.

This column displays the message associated with the issued alerts. It includes the email address to which the alert was sent and the score which caused the alert to be sent.


	NOTE: The scores shown for issued alerts are based on the configuration of the policy sending the alert. This means the scores will not always be the same as the risk score from the evaluation of the access attempt.

This column displays the risk policy that was evaluated.

This column displays the name of the user who accessed, or attempted to access, an application protected by the Security Analytics Engine.

This column displays the email address to which the alert was sent.

This column displays the status of the alert.

Filtering the issued alerts


	NOTE: Issued alerts follow the same retention settings as audit events.

The following procedure explains how to filter the alerts displayed in the Issued Alerts table. By default, the issued alerts for the current date are displayed.

To filter issued alerts


	NOTE: Refreshing the screen removes filtering and returns the Issued Alerts page to its default settings.

1

From the Home page, click Reports to open the Reports page.

2

From the Reports page, click Issued Alerts to open the Issued Alerts page.

3

In the From field, click anywhere in the field to display a calendar and select the start date. You can also manually edit the date in the field (mm/dd/yyyy).

4

In the To field, click anywhere in the field to display a calendar and select the end date. You can also manually edit the date in the field (mm/dd/yyyy).

5

In the Application(s) field, select to display alert information for all applications or a specific application.

6

In the Max Records field, set the maximum number of records (1-10000) to return for the search. By default, this is 1000 records.

7

Click the Search button to update the Issued Alerts table.

8

To further filter the list of issued alerts, use the

buttons to the right of each column heading. For more information, see To filter data.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center