Security Analytics Engine 1.1


	NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.


	NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.

Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with a configured application threat level. The following parameters are available:

Table 9. Associated w/ Application Threat Level parameters

Parameter

Description

Associated default condition

Identifier

Enter a name for the condition.

Associated w/ Application Threat Level (Default)

Description

Enter a description for the condition.

Application threat level association detected for the user or IP address.

Days To Check

The number of days to check for application threat level association. A maximum of 365 days can be checked.

Minimum Count

The minimum number of times a threat level has been detected per day. This must be a value between 1-9999.

Minimum Days

The minimum number of days that meet the Minimum Count criteria. A maximum of 365 days can be entered. The number of days entered must be equal to or lower than the Days To Check parameter.

Threat Level

Select an application threat level to monitor for:

•

•

•

•

•

Include Higher Threat Levels

Select this check box to include any threat levels returned that are higher than the one selected.

(Selected)

Checking for application threat level association

The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for an application threat level association.

How the Security Analytics Engine checks for application threat level association

A user attempts to access an application that uses an Associated w/ Application Threat Level condition type to check if the username or IP address is associated with the specified application threat level(s).


	NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking the selected application threat levels is not relevant. Therefore, the request is considered not associated with a threat level and the risk score is not affected.

The Security Analytics Engine compares the username and IP address against the SonicWALL records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with the specified application threat level(s) during that time frame), the request is not considered associated with the configured application threat level(s) and the risk score is not affected.

If this check returns as true (there is a record associated within the configured threat level(s) that fits all the parameters), the request is considered associated with the configured application threat level(s) and the risk score is increased.

Associated w/ Blacklist


	NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.


	NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.

Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with a blacklist. The following parameters are available:

Table 10. Associated w/ Blacklist parameters

Parameter

Description

Associated default condition

Identifier

Enter a name for the condition.

Associated w/ Blacklist (Default)

Description

Enter a description for the condition.

Blacklist association detected for the user or IP address.

Days To Check

The number of days to check for blacklist association. A maximum of 365 days can be checked.

Minimum Count

The minimum number of times activity associated with a blacklist has been detected per day. This must be a value between 1-9999.

Minimum Days

The minimum number of days that meet the Minimum Count criteria. A maximum of 365 days can be entered. The number of days entered must be equal to or lower than the Days To Check parameter.

Use Blacklist Type(s)

Select the blacklist(s) to use:

•

•

•

Checking for blacklist association

The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for a blacklist association.

How the Security Analytics Engine checks for blacklist association

A user attempts to access an application that uses an Associated w/ Blacklist condition type to check if the username or IP address is associated with a blacklist.


	NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking the selected blacklists is not relevant. Therefore, the request is considered not associated with a blacklist and the risk score is not affected.

The Security Analytics Engine compares the username and IP address against the SonicWALL records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with a blacklist during that time frame), the request is not considered associated with a blacklist and the risk score is not affected.

If this check returns as true (there is a record associated with a blacklist that fits all the parameters), the request is considered associated with a blacklist and the risk score is increased.

Associated w/ Country


	NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.


	NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.

Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with malware in a specified country. The following parameters are available:

Table 11. Associated w/ Country parameters
Parameter	Description	Associated default condition
Identifier	Enter a name for the condition.	Associated w/ Country (Default)
Description	Enter a description for the condition.	User or IP address identified as being associated with activity in specific countries.
Days To Check	The number of days to check for country association. A maximum of 365 days can be checked.	7
Minimum Count	The minimum number of times activity in a listed country has been detected per day. This must be a value between 1-9999.	1
Minimum Days	The minimum number of days that meet the Minimum Count criteria. A maximum of 365 days can be entered. The number of days entered must be equal to or lower than the Days To Check parameter.	1
Country	From the drop-down list of countries, select the check box for each country that is considered high risk if a user or IP address is associated with activity in the country.	3 item(s) selected - Iran, Islamic Republic of; Sudan; Syrian Arab Republic NOTE: These countries are from the following list posted by the U.S. Department of State: http://www.state.gov/j/ct/list/c14151.htm

Checking for country association

The following procedure explains how the Security Analytics Engine checks the user and IP address attempting to access an application for an association with activity in a specified country.

How the Security Analytics Engine checks for country association

A user attempts to access an application that uses an Associated w/ Country condition type to check if the username or IP address is associated with activity in a specified country.


	NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking for country association is not relevant. Therefore, the request is considered not associated with activity and the risk score is not affected.

The Security Analytics Engine compares the username and IP address against the records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with activity during that time frame), the request is not considered to come from a user or IP address associated with activity in a specified country and the risk score is not affected.

If this check returns as true (there is a record of activity for that username or IP address in that country that fits all the parameters), the request is considered associated with the country and the risk score is increased.

Associated w/ Malware


	NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.


	NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.

Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with malware. The following parameters are available:

Table 12. Associated w/ Malware parameters
Parameter	Description	Associated default condition
Identifier	Enter a name for the condition.	Associated w/ Malware (Default)
Description	Enter a description for the condition.	User or IP address identified as being associated with malware detection.
Days To Check	The number of days to check for malware association. A maximum of 365 days can be checked.	7
Minimum Count	The minimum number of times malware has been detected. This must be a value between 1-9999.	1

Checking for malware association

The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for an association with malware.

How the Security Analytics Engine checks for malware association

A user attempts to access an application that uses an Associated w/ Malware condition type to check if the username or IP address is associated with malware.


	NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking for malware is not relevant. Therefore, the request is considered not associated with malware and the risk score is not affected.

The Security Analytics Engine compares the username and IP address against the malware records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with malware during that time frame), the request is not considered associated with malware and the risk score is not affected.

If this check returns as true (there is a record associated with malware that fits all the parameters), the request is considered associated with malware and the risk score is increased.

製品を選択してください:

サービス向上のために、「Purpose of your Chat（チャットの目的）」を記入してください。

お客様の不具合に推奨されるソリューション

Security Analytics Engine 1.1 - User Guide

Associated w/ Application Threat Level

Associated w/ Blacklist

Associated w/ Country

Associated w/ Malware