One Identity Safeguard for Privileged Sessions 6.0.3 - Administration Guide

Analyzing data using One Identity Safeguard for Privileged Analytics

One Identity Safeguard for Privileged Sessions (SPS) integrates data from SPS to use as the basis of user behavior analysis. SPA uses machine learning algorithms to scrutinize behavioral characteristics (using data from SPS), and generates user behavior profiles for each individual privileged user. SPA compares actual user activity to user profiles in real time, with profiles being continually adjusted using machine learning. When SPA detects unusual activity, this is indicated on the user interface of SPS in the form of high scores and visualized insight.

Prerequisites

Make sure that you have session data from network traffic that:

• contains real, unique usernames linked to users other than root/administrator or a shared account

  To check this, navigate to Search, and check whether the Username column contains data. This is important, because session data will be linked to users.

  If you do not have unique usernames in your session data, review your authentication settings and consult with the One Identity Professional Services team to learn about your options to tie accounts to users.

• has commands extracted (using lightweight or full indexing, or in real-time through content policies)

  For instructions on how to configure indexing and include commands in the scope of indexing, see "Indexing audit trails" in the Administration Guide.

  For details on how to configure real-time command extraction using a content policy, see "Creating a new content policy" in the Administration Guide.

• has keystrokes extracted (using lightweight or full indexing, or in real-time through content policies)

  The minimum required amount of data for reliable insight is 5 sessions with approximately 200 keystrokes each.

  For instructions on how to configure indexing and include typing biometrics in the scope of indexing, see "Indexing audit trails" in the Administration Guide.

  For details on how to configure real-time extraction of keystroke-related data using a content policy, see "Creating a new content policy" in the Administration Guide.

• has window titles extracted (using lightweight or full indexing, or in real-time through content policies)

  For instructions on how to configure indexing and include window titles in the scope of indexing, see "Indexing audit trails" in the Administration Guide.

  For details on how to configure real-time window title extraction using a content policy, see "Creating a new content policy" in the Administration Guide.

The following describes how to analyze data using One Identity Safeguard for Privileged Analytics.

To start using SPA

1. Start getting scores.

   Scoring happens in real-time, meaning that as soon as new data (even data from an ongoing session) is available, SPA immediately scores it.

   TIP: When data is not immediately available to you and you are unable to wait until sufficient amount of data comes in from production traffic, you can resort to the following: Manually reindex historical sessions. For details, see "Reindex historical sessions" in the Safeguard for Privileged Analytics Configuration Guide. Specifically for window title data, run the pam-process-historical-window-titles command to invoke window title processing for sessions that have been both closed and indexed. This can be useful, for example, when you have upgraded from a SPS version earlier than 5 F6 or you simply have never used the window title algorithm, and therefore SPS has not done any window title processing before.

   Scores represent an aggregated amount. Session data is scored by multiple algorithms independent from each other. Scores given by individual algorithms are aggregated to create a single score.

   For detailed instructions on how to configure SPA, see Safeguard for Privileged Analytics Configuration Guide.

2. Search for sessions with high scores.

   1. Go to Search.

      Sessions are displayed sorted by date. For ongoing sessions, the Search interface is updated in real-time to always show the most up-to-date information.

   2. In the Search query field, type analytics.score.aggregated: [80 TO 100], and click Search.

      A score between 80 and 100 indicates unusual user behavior.

      Figure 225: Searching for sessions with unusual user behavior using a search query

      

      Results that show sessions with high scores are displayed.

      Figure 226: Sessions with high scores — table view

      

      Figure 227: Sessions with high scores — card view

      

3. Alternatively, search for scripted sessions.

   In the Search query field, type analytics.scripted:true, and click Search.

4. To view details of a session, click when you are in card view.

   Alternatively, click when you are in table view.

5. Click the Analytics tab.

   The top of the page displays a summary of key insights about the session, such as:

   • The aggregated score (indicated by a gauge). The following color codes are used:

     • Scores between 80-100 indicate unusual behavior, their color code is red.

     • Scores between 70-79 indicate behavior that might require further analysis and attention, their color code is amber.

     • Scores between 0-69 indicate normal behavior, their color code is gray.

   • A one-sentence summary of each algorithm's verdict about the session and user behavior.

   The Anomalies found and Normal behavior sections of the page display detailed analyses provided by each of the configured algorithms. This includes short information on how a particular algorithm works and how to read the visualized insight, as well as scores given by the individual algorithms.

   Figure 228: Search — Viewing details on the Analytics tab: Anomalies found

   

   

   Figure 229: Search — Viewing details on the Analytics tab: Normal behavior

   

   

The search and filter process

The screen content is first indexed, then processed with the search backend, and finally, the filter expressions are applied. This process is described in detail in the following sections.

Figure 230: The search and filter process

Prerequisites - Indexing phase

First, as a prerequisite of the search process, screen content is indexed. The indexing phase generates a database that the search and filter processes will run on.

The indexer parses the audit trail files, and builds an "inventory" of the privileged user's activity data based on what appeared on their screen.

1. In the case of a terminal session, screen content corresponds to the activity data that is captured in a terminal window. In the case of graphical protocols, screen content is whatever is visible in the graphical user interface of the applications the user is interacting with. In the latter case, the indexer's Optical Character Recognition (OCR) engine extracts text that appeared on the screen (for example, window titles).

   NOTE: If a piece of text is displayed for less than 1 second, it is not extracted.

2. The indexer returns the information extracted from the parsed audit trail files to One Identity Safeguard for Privileged Sessions (SPS). In the case of a terminal session, the captured text is put in the backend database as one document per one second of screen content. Because of this, the content that you have searched for might only partially appear in the screenshot. In the case of graphical protocols, the captured text is put in the backend database as one document per screenshot.

3. The queries will be run on this database during the search process.

For details on indexing, see Indexing audit trails.

Search and filter process phases

The search and filter process consists of three major phases:

• Query phase

• Grouping phase

• Filter phase

Query phase

In the query phase, the backend ranks and then limits the number of results.

1. The result of one query is the top 3000 documents, ordered by the default ranking system of the backend.

   This means that if there are more than 3000 results, those of the lowest rank will not be passed to the next phase at all.

   The ranking system cannot be modified, so there is no way to "upvote" those results of lower ranks.

   If you want to ensure that all important results are passed to the grouping phase, use a smaller time range that you run the query on. If there are fewer than 3000 results, it is certain that the events you are interested in will be included in the grouping phase.

2. The grouping phase receives the results.

Grouping phase

The grouping phase groups the results that were passed on from the query phase.

1. First, the results with the same trail IDs are grouped together. A trail ID group contains all search hits that are in that trail.

2. The trail ID groups are then further grouped by seach expression and time range. This group is essentially the time range during which the expression is displayed on the screen (for example, if the text root is displayed from 00:00:12 to 00:01:45, this will be one group).

3. This grouped result is displayed in the search screen as one row.

Filter phase

The filter phase applies filter expressions to these grouped results.

Fine-tuning the backend search manually

You can fine-tune your search manually with the command line utility lucenectl. To do this, log on to the core shell. For details, see Accessing the One Identity Safeguard for Privileged Sessions (SPS) console.

• Specify more exact time ranges (use Unix timestamps).

  For example, to limit the time range to Thursday, June 30, 2016 11:39:51 AM - Thursday, November 3, 2016 2:44:46 PM, enter the following command:

  lucenectl search --from-to 1467286791 1478184286 --text remote --limit 3000 --aggregate-by-trail --normalize-rank

  NOTE: For converting timestamps to Unix timestamp, use https://www.epochconverter.com/.

• Increase the query limit of 3000 to a limit of your choice.

  For example, to increase the query limit of 3000 to 4500, enter the following command:

  lucenectl search --from-to 1467286791 1478184286 --text <your-screen-content-search-expression> --limit 4500 --aggregate-by-trail --normalize-rank

  lucenectl search --from-to 1467286791 1478184286 --text remote --limit 4500 --aggregate-by-trail --normalize-rank

  NOTE: If you do not receive more results with a larger query limit, it means that you have found all results with your search expression.

However, the downside of using lucenectl to fine-tune your search is that after the cli search, you have to manually extract the trails that you find interesting with the help of the metadb.

The following example shows the output of a lucenectl search:

{
 "hits": [
   {
     "hits_count": 1,
     "channel_id": 1,
     "trail_id": "58",
     "rank": 0.4068610216585047
   },
   {
     "hits_count": 7,
     "channel_id": 761,
     "trail_id": "12",
     "rank": 1.0
   },
   {
     "hits_count": 2,
     "channel_id": 1,
     "trail_id": "139",
     "rank": 0.5923645275802537
   }
 ]
}

• rank: the larger the number, the higher the rank

• hits_count: the number of times the screen content search expression is displayed in the audit trail

• trail_id: the ID of the trail

• channel_id: the ID of the channel

The most relevant audit trail will probably be the one with the highest rank.

If you have determined which audit trail you are interested in, enter the following command. The value of _connection_channel_id will be the value of the trail_id from the lucenectl output that you have determined as most relevant.

psql -U scb scb -c "select audit from channels where _connection_channel_id = 12;"

The output of this command will be:

/<audittrailpath>/audit-scb_rdp-1467274538-0.zat:2
/<audittrailpath>/audit-scb_rdp-1467274538-0.zat:1

From this output, the audit trail file name path is as follows: /<audittrailpath>/audit-scb_rdp-1467274538-0.zat

psql -U scb scb -c "select audit, _archive_path  from channels where _connection_channel_id = 12;"

                    audit                                | _archive_path
---------------------------------------------------------+---------------
/<audittrailpath>/audit-scb_rdp-1467274538-0.zat:2 | /<myarchive/path>/
/<audittrailpath>/audit-scb_rdp-1467274538-0.zat:1 | /<myarchive/path>/
                                                         | 

Viewing session details

The session info window provides in-depth information on each of the indexed session stored in the connection database. You can use it to gain contextual insight about the indexed session and its events.

Access the session info window in the following ways:

• In card view, click the button in the last column of the relevant session.

• In table view, click the button.

  Figure 231: Search — Accessing session details

  

The session info window is displayed:

Figure 232: Session details

The session info window provides details about the sessions on tabs.

Overview tab

The Overview tab is divided into the following main areas:

• The Events area displays session events in chronological order.

  View the date and time of the event, the event type and event details. To filter events, use the Events tab.

• The Score area shows the risk score that the Analytics Module assigned to the session. Ranges from 0 to 100, 100 is the highest risk score.

• The Quick look area contains user information, for example, gateway and server username, start and end time of the session, and so on.

  The gateway username corresponds to the Username field of the connection metadata database, so note the following:

  • If the user performed inband gateway authentication in the connection, the field contains the username from the gateway authentication (gateway username).

  • Otherwise, the field contains the username used on the remote server.

• The Interesting events area displays events selected as interesting, for example, a list of commands and window titles from the session that could be interesting from a security point of view.

  The list of interesting events is currently hard-coded and cannot be modified. For terminal sessions it includes commands such as chmod, ssh, shutdown, sudo, su, mount, adduser, addgroup. For graphical sessions, it contains window titles such as Management Console, Control Panel, Server Manager, PowerShell, Security Settings, Windows Security Center.

• The Network area displays session information, for example, verdict, protocol, connection policy, client and server address.

Details tab

In addition to the Quick look, Interesting events, and Network screen areas, the Details tab provides monitoring information and channels information, too.

Events tab

The Events tab displays the:

• Session events in chronological order.

  You can narrow the event list by entering the event name in the Filter events field.

• Date and time of the event.

• Event type (command, screen content, window title).

• Event details.

Alerts tab

The Alerts tab displays the:

• Content policy alerts triggered in the session, in chronological order.

  You can narrow the alert list by entering the alert name in the Filter alerts field.

• Date and time of the alert.

• Alert details.

• Screenshots. If screenshots are available for the session, you can click each alert to view the corresponding screenshot.

Screenshots are generated for search results and alerts when the session is opened, and for subsequent searches.

Screenshots are not available for:

• Ongoing sessions.

• Unindexed sessions.

• Trails of HTTP sessions.

• Encrypted trails (without the necessary certificate).

Contents tab

You can search in the contents of the audit trails as follows:

• From your browser: Use this method to find all the sessions containing your search query.

  Enter the screen.content: expression search filter in the Search query field. For example: screen.content="exit". The search returns all the sessions where exit was on the screen.

• From the Safeguard Desktop Player application: Use this method to find the exact location of the search query within a specific audit trail.

  Download the relevant audit trail, open it in the Safeguard Desktop Player application, and use the Search feature. You can also search in the contents of the audit trails for trails of graphical sessions created and indexed with One Identity Safeguard for Privileged Sessions (SPS) 6.0.

For more information, see Searching in the contents of audit trails.

Analytics tab

If you use the One Identity Safeguard for Privileged Analytics, you can view detailed analyses provided by the configured algorithms. For more information, see Analyzing data using One Identity Safeguard for Privileged Analytics.

Viewing active connections

If a connection is not closed and is still active, the label is displayed in the session info window.

To close an active connection, click the label.

You can also view the live connection as follows:

1. Click the label.

2. Download the audit trail.

   Trail data is exported in .srs format, which you can open with the Safeguard Desktop Player application.

   For more information on the Safeguard Desktop Player, see Safeguard Desktop Player User Guide.

Session tags

Session tags allow you to get basic information about the session and its contents at a glance.

Scripted session tag: One Identity Safeguard for Privileged Sessions (SPS) currently supports the scripted session tag. SPS uses One Identity Safeguard for Privileged Analytics to detect if sessions are generated using human interaction or automation. If sessions are generated using automation, SPS displays the scripted tag in the search interface as shown below:

• Scripted sessions are shown on the main search screen.

  Figure 233: Scripted sessions — cards view

  

• Scripted sessions are shown on the Overview tab.

  Figure 234: Scripted sessions — Overview tab

  

Replaying audit trails in your browser

The following describes how to create and replay an audit trail in your browser.

To replay an audit trail in your browser

1. On the Search page, find the audit trail you want to replay.

2. Click to display the details of the connection.

   Alternatively, in the table view, click .

3. Click to generate a video file from the audit trail you want to replay. Depending on the load of the indexer and the length and type of the audit trail, this can take several minutes.

   When the video is available, changes to and . You can use the button if you want to remove the generated video. After you remove the video file, the button is available and you can use it to recreate the video file.

4. (Optional) If you have encrypted audit trails but the necessary certificates and private keys are not uploaded into your private keystore, you have to upload the keys first. After uploading them, click . The feature decrypts the encrypted upstream traffic elements. As a result, they will be displayed distributed in the generated video (see List of keyboard events, Show / hide events, and both versions of the Progress bar in the The Player window has the following controls: below).

5. To replay the video, click .

   The Player window opens.

   Figure 235: Replaying audit trails in your browser

   

   TIP: You can quickly zoom in or out by clicking anywhere in the Player window.

   The Player window has the following controls:

   • : Play, Pause

   • , : Jump to previous event, Jump to next event

   • : Adjust replay speed

   • : Time since the audit trail started / Length of the audit trail. Click on the time to show the date (timestamp) of the audit trail.

   • : List of keyboard events. Special characters like ENTER, F1, and so on are displayed as buttons. If the upstream traffic is encrypted, upload your permanent or temporary keys to the User menu > Private keystore to display the keyboard events. This will not be displayed if your upstream traffic is encrypted but not unlocked.

   • : Active mouse button

   • : Create a screenshot

   • : Show / hide events. Select the types of events to display. Depending on the protocol used and how the audit trail was processed, One Identity Safeguard for Privileged Sessions (SPS) can display keyboard events, commands, mouse events, and window titles. Commands and window titles are displayed as subtitles at the top of the screen. This will not be displayed if your upstream traffic is encrypted but not unlocked.

   • : Fullscreen mode

   • : Progress bar

   • : Shows the distribution of events. Blue - commands, green - keyboard events, yellow - mouse events, orange - window title. This will not be displayed if your upstream traffic is encrypted but not unlocked.

   • : Close the player, and return to the Connection details page.