Security Analytics Engine 1.0

Table 3. Abnormal Browser parameters
Parameter	Description	Default
Identifier	Enter a name for the condition.	Abnormal Browser (Default)
Description	Enter a description for the condition.	Determines whether the browser has been used in the past.
Days to check	The number of days to check for the browser ID. For example, if set to 3 the data from the last 3 days is used for comparison. A maximum of 365 days can be checked.	30

Checking for an abnormal browser

The following procedure explains how the Security Analytics Engine checks the browser attempting to access an application to determine if it is an abnormal browser for the user.

How the Security Analytics Engine checks for an abnormal browser:

A user attempts to access an application that uses an Abnormal Browser condition type to check for abnormal browsers.

The Security Analytics Engine checks if this access attempt is from a browser not used by the user within the time period specified by the condition. If this returns as false (it is a previously used browser), the browser is considered normal and the risk score is not affected.

If this returns as true (the browser was not previously used within the specified time period), the browser is considered abnormal and the risk score is increased.

Abnormal Location


	NOTE: The GeoLocationPlugin is associated with this condition and provides important settings.

This type of condition uses the previous location and maximum travel velocity to determine if the user or device could be at the current physical location. The following parameters are available:

Table 4. Abnormal Location parameters
Parameter	Description	Default
Identifier	Enter a name for the condition.	Abnormal Location (Default)
Description	Enter a description for the condition.	Determines whether the user or device originates from an IP address that conforms with previous user or device behavior.
Maximum Travel Speed	The kilometers per hour a person or device can travel between access attempts. The travel speed cannot exceed 9999 kilometers per hour.	1000
Also Report Unknown Location	Select this check box to report an unknown location, such as an anonymous proxy or satellite provider, as abnormal. If this is not selected, an unknown location will not be considered abnormal.	Selected

Checking for an abnormal location

The following procedure explains how the Security Analytics Engine checks the location of a user or browser attempting to access an application.

How the Security Analytics Engine checks for an abnormal location:

A user attempts to access an application that uses the Abnormal Location condition type to check for abnormal geolocations.


	NOTE: If there is no user ID or browser ID in the access request, checking the geolocation is not relevant. Therefore, the geolocation is considered normal and the risk score is not affected.

The Security Analytics Engine checks if this access attempt is from an internal network. If this check returns as true (it is from an internal network), the geolocation is considered normal and the risk score is not affected.

If the internal network check returns as false, the Security Analytics Engine checks the VPN Networks (IP address and subnet mask) configured for the GeoLocationPlugin. If this check returns as true (the VPN is configured), the geolocation is considered normal and the risk score is not affected.

If the VPN check returns as false, the Security Analytics Engine checks if this is the first access attempt from the IP address for the user or device. If this check returns as true (it is the first access attempt from the IP address), the geolocation is considered abnormal and the risk score is increased.

Next, the Security Analytics Engine compares the current IP address with the last IP address the user and device successfully signed in on. If the IP addresses match (both the user and device last signed in from this IP address), the geolocation is considered normal and the risk score is not affected.

If the IP addresses are different, the Dell™ OnDemand Service gets passed the incoming IP address and returns the geographic coordinates of the IP address. The Security Analytics Engine compares the geographic coordinates for the current and last IP address, and calculates the distance between them to ensure that the IP addresses are not separated by a distance deemed impossible to travel within the amount of time between access attempts (i.e., the user cannot log in to the application from Canada an hour before logging in from India). If the Security Analytics Engine determines that the distance between IP addresses is possible within the time frame, the geolocation is considered normal and the risk score is not affected.


	NOTE: If the Security Analytics Engine cannot connect to the OnDemand Service at the time of the access attempt and the Also Report Unknown Location check box is selected, the geolocation is considered abnormal based on the previous steps and the risk score is increased. If the Security Analytics Engine cannot connect to the OnDemand Service at the time of the access attempt and the Also Report Unknown Location check box is cleared, an unknown geolocation is reported as normal and the risk score is not affected.

If the Security Analytics Engine determines the distance between the IP addresses is too far apart within the time frame, the Security Analytics Engine considers the geolocation abnormal and the risk score is increased.

Abnormal Time


	NOTE: The BuiltinPlugin is associated with this condition and provides important settings.

This type of condition determines if the access request falls within the normal access time pattern previously established by the user. The following parameters are available:

Table 5. Abnormal Time parameters
Parameter	Description	Default
Identifier	Enter a name for the condition.	Abnormal Time (Default)
Description	Enter a description for the condition.	Determines whether the request arrives within the normal time pattern established by previous user behavior.
Days to check	The number of days to check the access times for a user. For example, if set to 3 the data from the last 3 days is used for comparison. A maximum of 365 days can be checked.	30
Minimum Count	The minimum number of access times required to establish a normal access time. This cannot exceed 99 access times.	1
Tolerance, hours	The number of hours before and after the access time to accept. For example, if the user habitually logs in at 8 a.m. and the tolerance is set to 1, any time between 7 a.m. and 9 a.m. is considered acceptable. The maximum tolerance setting is 12 hours.	1

Checking for an abnormal time

The following procedure explains how the Security Analytics Engine checks the time of an access attempt to determine if it is an abnormal access time for the user.

How the Security Analytics Engine checks for an abnormal time:

A user attempts to access an application that uses the Abnormal Time condition type to check for an abnormal access time.

The Security Analytics Engine uses stored information in order to determine if an access attempt corresponds with an established normal access time. This normal access time is determined by the following three factors:

•

The number of days to use for comparison.

•

A set of hourly time slots during which the user previously logged in. For example, a login any time between 6:00 a.m and 6:59 a.m. would be associated with the 6 a.m. time slot.

•

A tolerance level for access times. This allows a user to access an application within a time period rather than limiting access to an exact time.

The Security Analytics Engine gathers the normal access time information and checks the current access attempt to see if it falls within the pattern established by the user. If this check returns as true (there is both enough data to determine an access pattern and the access attempt fits within this pattern), the access time is considered normal and the risk score is not affected.

If this returns as false (it occurred outside of the normal access time or there is not enough data to compare the access attempt to), the access time is considered abnormal and the risk score is increased.

Associated w/ Malware


	NOTE: This condition is associated with the MalwareDetectionPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.


	NOTE: The MalwareDetectionPlugin is associated with this condition and provides important settings.

This type of condition checks if the user or IP address was reported by the malware scanner. The following parameters are available:

Table 6. Associated w/ Malware parameters
Parameter	Description	Default
Identifier	Enter a name for the condition.	Associated w/ Malware (Default)
Description	Enter a description for the condition.	Determines whether the user or IP address were reported by malware scanner.
Days to check	The number of days to check for malware association. A maximum of 365 days can be checked.	30

Checking for malware association

The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for an association with malware.

How the Security Analytics Engine checks for malware association:

A user attempts to access an application that uses the Associated w/ Malware condition type to check if the username or IP address is associated with malware.


	NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking for malware is not relevant. Therefore, the request is considered not associated with malware and the risk score is not affected.

The Security Analytics Engine compares the username and IP address against the malware records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with malware during that time frame), the request is not considered associated with malware and the risk score is not affected.

If this check returns as true (there is a record associated with malware), the request is considered associated with malware and the risk score is increased.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Security Analytics Engine 1.0 - User Guide

Abnormal Browser

Abnormal Location

Abnormal Time

Associated w/ Malware