Chat now with support
Chat with Support

Security Analytics Engine 1.0 - User Guide

Managing risk policies

After a risk policy is added to an application, it appears listed on the Applications page and can now be edited, duplicated or deleted.
To edit a risk policy:
1
On the Applications page, select the application currently using the risk policy.
2
Click the button to open the Edit Application dialog.
3
In the Policies section, select the Policy to be edited and click the button to open the Edit Policy dialog.
4
To change the conditions currently used by the policy, click the button to open the Select conditions to monitor dialog.
5
After making changes to the selected conditions, click OK to close the Select conditions to monitor dialog and return to the Edit Policy dialog.
6
The Edit Policy dialog displays the selected conditions according to their effect on the risk score. Each condition will have a slider bar associated with it that is used to assign a score to the condition. For Bad Conditions the slider will raise risk scores when the condition is triggered during an access attempt, while Good Conditions will lower the risk score when triggered.
•
Bad Conditions - Move the slider from left to right to increase the score between 0 (ignores the condition) and Major Threat (increases the risk score by 1000).
•
Good Conditions - Move the slider from right to left to decrease the score between 0 (ignores the condition) and Safe (decreases the risk score by 100).
7
(Optional) To preview possible risk scores and threat levels that can occur for the risk policy, click the button in the upper right corner of the dialog to enable Preview Mode. Edits to the condition scores are allowed while preview mode is active.
•
Select any of the check boxes to the left of a condition to preview what risk score and threat level will occur should the selected condition(s) be triggered during an access attempt.
The following fields at the top of the dialog will update as conditions are selected:
•
Real sum of conditions - This field displays the risk score that would occur if all selected conditions were triggered.
•
Threat level reported - This field displays the threat level that the Security Analytics Engine would send to the application if all selected conditions are triggered. The highest reportable threat level is 7.
* 
NOTE: Depending on the conditions selected, the Real sum of conditions and Threat level reported fields may display different numbers. This occurs when the total possible risk score is higher or lower than the values that can be reported as a threat level (0-7).
For example, if a selected condition is assigned a score of Major Threat the value of the Real sum of conditions will be 1000. However, the Security Analytics Engine will only send the application the highest reportable threat level (7) which is displayed in the Threat level reported field.
•
Click the button to close preview mode.
8
Once you have finished editing the risk scores, click the Save button to save changes and close the Edit Policy dialog.
9
Click the Save button on the Edit Application dialog to save the application and return to the Applications page.
To duplicate a risk policy:
1
On the Applications page, select the application currently using the risk policy you want duplicated.
2
Click the button to open the Edit Application dialog.
3
In the Policies section, select the Policy to be duplicated and click the button to open the Add Policy dialog populated with the conditions and scores assigned in the original risk policy.
4
In the Policy Name field, enter a name for the risk policy.
5
After editing the duplicate risk policy, click the Save button to return to the Edit Application dialog.
6
The duplicated policy will now appear in the Policies section. Click Save to return to the Applications page.
To delete a risk policy:
* 
IMPORTANT: The Security Analytics Engine is not aware of applications’ usage of risk policies. Before deleting a risk policy, ensure that the application is not sending requests to evaluate the risk policy that is to be deleted.
1
On the Applications page, select the application currently using the risk policy.
2
Click the button to open the Edit Application dialog.
3
In the Policies section, select the Policy to be deleted and click the button.
4
A dialog is displayed confirming that you want to delete the selected risk policy. Click the Delete button.
5
The deleted policy will no longer appear listed in the Policies section of the Edit Application dialog. Click Save to return to the Applications page.

Application wizard

The Application wizard consists of a series of dialogs displayed when the button or the button are clicked on the Applications page. This wizard is used to connect applications to the Security Analytics Engine and manage the risk policies associated with them.
The following table provides a description of the options available in the Application wizard.
 
Table 13. Application wizard
Add Application/Edit Application dialogs
These dialogs allow you to add or edit an application. They are accessed by either clicking the button to open the Add Application dialog, or selecting a previously created application and clicking the button to open the Edit Application dialog.
Application Name
Enter a unique name for the application. This is a display name that is only used while managing your application within the Administration web pages.
Application Description
(Optional) Enter a brief description for the application. This description is only used within the Administration web pages.
Client API ID
Enter the client’s API ID. The API ID cannot be a used again for another application.
Client API Secret
Click the button in this field to display the text of the API secret.
Generate New
Clicking this button generates a new client API secret.
Policies section
This section of the wizard allows you to add new policies and edit existing policies. The policies currently applied to the application are listed.
Click this button to open the Add Policy dialog.
After selecting a policy, click this button to open the Edit Policy dialog. This page is identical to the Add Policy dialog except it includes all information previously entered for the selected policy.
After selecting a policy, click this button to duplicate the selected policy. The Add Policy dialog will appear populated with the settings from the original policy.
After selecting a policy, click this button to delete the selected policy. A confirmation dialog will appear, click Delete to delete the policy.
Buttons
The following buttons appear across the bottom of the Application wizard.
Save
Click this button to save the application.
Close
Click this button to close the dialog. If changes were made to the application, a warning will appear allowing you to select whether or not to save the changes before closing the dialog.
Add Policy/Edit Policy dialogs
These dialogs allows you to add or edit a risk policy. They are accessed by either clicking the button to open the Add Policy dialog, or selecting a previously created application and clicking the button to open the Edit Policy dialog.
Policy Name
Enter a unique name for the policy.
Description
(Optional) Enter a description for the policy.
Disable policy override
Select this check box to disable overrides for this risk policy.
How does this work?
Click this link to open the Using the Policy Editor dialog which provides a brief overview of how to use the Policy Editor. Click Close to close the dialog.
Click this button to open the Select conditions to monitor dialog.
Click this button to preview the risk policy. Once preview mode is active, select any of the check boxes to the left of a conditions name to preview the risk score and threat level that would occur should the selected condition(s) be triggered during an access attempt. The following fields at the top of the dialog will update as conditions are selected:
•
Real sum of conditions - This field displays the risk score that would occur if all of the selected conditions were triggered.
•
Threat level reported - This field displays the threat level that the Security Analytics Engine would send to the application if all selected conditions are triggered. The highest reportable threat level is 7.
Click the button to close preview mode.
Save
Click this button to save the risk policy.
Close
Click this button to close the dialog. If changes were made to the risk policy, a warning will appear allowing you to select whether or not to save the changes before closing the dialog.
The following appear once selections have been made on the Select Conditions dialog:
Bad Conditions
Beneath this heading are the selected conditions that will increase a risk score if triggered.
This slider moves from left to right to increase the score. The following scores can be applied to a bad condition:
•
0 - Not a threat. Ignore. (Default)
•
1 - Minor threat.
•
2
•
3
•
4 - Moderate threat.
•
5
•
6
•
Major Threat. Increase risk score by 1000.
Good Conditions
Beneath this heading are the selected conditions that will decrease a risk score if triggered.
This slider moves from right to left to decrease the score. The following scores can be applied to a good condition:
•
0 - Does not impact threat level. (Default)
•
-1 - Minor decrease in risk score.
•
-2
•
-3
•
-4 - Moderate decrease in risk score.
•
-5
•
-6
•
Safe. Decrease risk score by 100.
Select conditions to monitor dialog
Opened when the button is clicked, this dialog is used to select the conditions to include in a risk policy.
Bad Conditions
This tab displays all of the available bad conditions. Selecting a condition type from the left column will display the related conditions in the right column. Select the check box for each condition to use within the risk policy.
Good Conditions
This tab displays all of the available good conditions. Selecting a condition type from the left column will display the related conditions in the right column. Select the check box for each condition to use within the risk policy.
OK
Click this button to save changes and return to the Add Policy/Edit Policy dialog.

Auditing

•
Introduction
•
Auditing page
•
Filtering the audit events
•
Configuring the retention settings
•
Displaying details for an individual audit event
•
Adding and managing overrides on the Auditing page

Introduction

From the Home page of the Security Analytics Engine Administration web site, click on the Auditing link to open the Auditing page where you can view and manage the auditing data captured by the Security Analytics Engine. This page is also used for overriding a user’s risk score to allow them access to the Security Analytics Engine protected applications for a specified period of time.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating