Security Analytics Engine 1.0

Security Analytics Engine 1.0 - User Guide

Adding and managing overrides on the Policy Overrides page


	NOTE: Policy overrides can also be created and managed on the Auditing page by selecting specific audit events. See Auditing page for more information.


	NOTE: In cases where overrides have been disabled for a risk policy, the threat level will always be reported regardless of whether or not there is an override in place for the user.

Adding a policy override

When a user has failed to authenticate due to a high threat level, you can create an override to allow that user access to the Security Analytics Engine protected applications for a specified period of time.


	IMPORTANT: To avoid allowing a malicious user access to an application, only create an override when you are positive the user is legitimate.

To add a policy override:

From the Home page, click Policy Override.

Click the Add Override button in the upper right corner to open the Add Override dialog.

In the User Name field, enter the name of the user to whom the override applies.

(Optional) For Browser ID, enter the browser ID for the user.

(Optional) In the User Address field, enter the user’s IP address.

In the Expiration field, click the

button to select an expiration date for the override. By default, the next day is selected.

Click the Save button to save the override and close the dialog. The new override appears on the Policy Overrides page.

Managing a policy override

To edit a policy override:

From the Home page, click Policy Override.

Select the override to edit and click Edit to open the Modify Override dialog.

The following information is displayed for the override:

•

Last Updated By: <nn> - The username of the administrator or help desk operator that last created or modified the override.


	NOTE: This field cannot be edited.

•

User Name - The name of the user to whom the override applies.


	NOTE: This field cannot be edited.

•

Browser ID - The Browser ID to which the override applies.

•

User Address - The IP address to which the override applies.

•

Expiration - Click the

button to select an expiration date for the override.

Click the Save button to save the changes to the override and close the dialog. The changes to the override are now in effect for the user until the specified expiration.

To delete a policy override:

From the Home page, click Policy Override.

On the Policy Override page, use one of the following methods to delete a policy override:

•

Locate the policy override to delete and click the corresponding Delete button.

•

Click the Edit button associated with the override to open the Modify Override dialog. Click the Delete button.

•

Select the check box to the left of the policy override(s) to delete and click the Delete Selected Overrides button located in the lower left corner.

A dialog will display confirming that you want to delete the selected override(s). Click the Delete button.

Fallback Password

•

Introduction

•

Fallback Administrator Password page

Introduction

From the Home page of the Security Analytics Engine Administration web site, click on the Fallback Password link to open the Fallback Administrator Password page where you can manage the fallback password used for accessing the Security Analytics Engine Administration web pages.

Fallback Administrator Password page

The Fallback Administrator Password page is displayed when Fallback Password is clicked on the Home page of the Security Analytics Engine Administration web site.