Security Analytics Engine 1.2 - User Guide

Add Application/Edit Application dialogs

These dialogs allow you to add or edit an application. They are accessed by either clicking the button to open the Add Application dialog, or selecting a previously created application and clicking the button to open the Edit Application dialog.

Enter a unique name for the application. This is a display name that is only used while managing your application within the Administration web pages.

(Optional) Enter a brief description for the application. This description is only used within the Administration web pages.

Enter the client’s API ID. The API ID cannot be a used again for another application.

Click the button in this field to display the text of the API secret.

Clicking this button generates a new client API secret.

Click this button to open the Add Policy dialog.

After selecting a risk policy, click this button to open the Edit Policy dialog. This page is identical to the Add Policy dialog except it includes all information previously entered for the selected risk policy.

NOTE: This button is replaced by the button when a shared risk policy is selected from the table. See Adding and managing shared risk policies for information on editing shared risk policies.

After selecting a shared risk policy, click this button to open the View Policy dialog where you can preview the shared risk policy and simulate risk scores using the button in the upper right corner of the dialog. Edits to the shared risk policy cannot be made on this dialog.

NOTE: This button replaces the button when a shared risk policy is selected from the table.

After selecting a risk policy, click this button to duplicate the selected risk policy. The Add Policy dialog appears populated with the settings from the original risk policy.

The function of this button changes depending on the type of risk policy selected.

• After selecting a risk policy, click this button to delete the selected risk policy. A confirmation dialog appears, click Delete to delete the risk policy.
• After selecting a shared risk policy, click this button to remove the selected shared risk policy from the application. A confirmation dialog appears, click Remove to remove the risk policy. To delete a shared risk policy, see Deleting a shared risk policy.

Click this button to open the Available Shared Policies dialog.

The name assigned to the risk policy on the Add/Edit Policy dialog.

The optional description of the risk policy from the Add/Edit Policy dialog.

Check marks in this column indicate that this is a shared risk policy.

Check marks in this column indicate that alerting is enabled for the risk policy. All risk policies with alerting enabled that appear in the Policies section will generate alerts.

Click this button to save the application.

Click this button to close the dialog. If changes were made to the application, a warning appears allowing you to select whether to save the changes before closing the dialog.

Add Policy/Edit Policy dialogs

These dialogs allow you to add or edit a risk policy. They are accessed by either clicking the button to open the Add Policy dialog, or selecting a previously created application and clicking the button to open the Edit Policy dialog.

Enter a unique name for the risk policy.

(Optional) Enter a brief description for the risk policy.

Select this check box to disable overrides for this risk policy.

Click this link to open the Using the Policy Editor dialog which provides a brief overview of how to use the Policy Editor. Click Close to close the dialog.

Click this button to open the Select conditions to monitor dialog.

Click this button to preview the risk policy. Once preview mode is active, select any of the check boxes to the left of a condition or modifier name to preview the risk score that would occur should the selected items be triggered during an access attempt. The Risk Score field displays the risk score that would occur if all the selected conditions and modifiers were triggered.

Click the button to close preview mode.

Click this button to approve the risk policy. The risk policy will not be saved until the Save button is clicked on the Add/Edit Application page.

Click this button to close the dialog. If changes were made to the risk policy, a warning appears allowing you to select whether to save the changes before closing the dialog.

Alerting section - This section of the wizard allows you to configure alerting for the risk policy. Click the Alerting heading on the left-hand side of the dialog to display the available settings.

Select the check box to begin sending email alerts and in the field enter the email address of the person that will be receiving the alerts.

Select the check box to send an email alert to the user attempting access when they exceed a certain score.

If Notify User is selected, click this button to open the Customize User Alert Email dialog which is used for customizing the subject and descriptive body text of the alert email sent to the user. Once edits are made, click Accept to close the dialog.

Select one of the following options:

• Always - Send alerts when a risk policy is evaluated by the application and when the application updates user behavior data.
• Only when specified - Sends an alert when the risk policy used for evaluation generates a risk score for the application.

In this field enter the minimum risk score (1 to 100) a user must receive in order for an alert to be sent.

Beneath this collapsible heading are the selected conditions within the Application category.

Beneath this collapsible heading are the selected conditions within the Behavior category.

Beneath this collapsible heading are the selected conditions within the Location category.

Beneath this collapsible heading are the selected conditions within the Network category.

Beneath this collapsible heading are the selected conditions within the User category.

This button appears to the left of each condition name and when clicked displays the modifiers currently assigned to the condition. If no modifiers are currently selected for the condition, this button is grayed out.

This button appears to the left of each condition name and when clicked opens the Select condition modifiers dialog. Click OK to close the dialog once selections are made.

This button appears to the left of each modifier name and when clicked removes the modifier from the condition.

The Can increase risk slider moves in increments of 10 between 100%-200%. A modifier set to 100% will not affect the condition when triggered and a modifier set between 110%-200% increases the condition score.

The Can decrease risk slider moves in increments of 10 between 0%-100%. A modifier set to 100% will not affect the condition when triggered and a modifier set to between 10%-90% decreases the condition score. A modifier set to 0% cancels out the condition score.

The Can both increase or decrease risk slider moves in increments of 10 between 0%-200%. A modifier set to 0% cancels out the condition score, a modifier set to between 10%-90% decreases the condition score, a modifier set to 100% will not affect the condition when triggered, and a modifier set between 110%-200% increases the condition score.

Select conditions to monitor/Select condition modifiers dialog

These dialogs allow you to add or edit the conditions/modifiers selected for the risk policy. They are accessed by either clicking the button to open the Select conditions to monitor dialog, or selecting the button associated with a condition to open the Select condition modifiers dialog.

This column displays the names of all available conditions/modifiers. Select the check box for a condition/modifier to use it within the risk policy.

This column displays the type of condition/modifier.

Click this button to close the dialog if no changes have been made. This button is replaced by the OK button if changes have been made.

Click this button to save changes and return to the Add Policy/Edit Policy dialog. This button replaces the Close button if changes have been made.

Available Shared Policies dialog

Opened when the button is clicked on the Add Application/Edit Application dialog, this dialog is used to select a shared risk policy for the application. Any shared risk policies that are not already associated with the current application are listed.

Click this button to approve your selection and close the dialog.