Chat now with support
Chat with Support

Security Analytics Engine 1.1 - User Guide

Security Analytics Engine Overview Plugins Conditions Shared Policies Applications Auditing Issued Alerts Policy Overrides Fallback Password Security Settings Glossary

Associated w/ Application Threat Level

* 
NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.
* 
NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.
Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with a configured application threat level. The following parameters are available:
Table 9. Associated w/ Application Threat Level parameters
Parameter
Description
Associated default condition
Identifier
Enter a name for the condition.
Associated w/ Application Threat Level (Default)
Description
Enter a description for the condition.
Application threat level association detected for the user or IP address.
Days To Check
The number of days to check for application threat level association. A maximum of 365 days can be checked.
7
Minimum Count
The minimum number of times a threat level has been detected per day. This must be a value between 1-9999.
1
Minimum Days
The minimum number of days that meet the Minimum Count criteria. A maximum of 365 days can be entered. The number of days entered must be equal to or lower than the Days To Check parameter.
1
Threat Level
Select an application threat level to monitor for:
•
Low
•
Guarded
•
Elevated
•
High
•
Severe
High
Include Higher Threat Levels
Select this check box to include any threat levels returned that are higher than the one selected.
(Selected)
Checking for application threat level association
The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for an application threat level association.
How the Security Analytics Engine checks for application threat level association
1
A user attempts to access an application that uses an Associated w/ Application Threat Level condition type to check if the username or IP address is associated with the specified application threat level(s).
* 
NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking the selected application threat levels is not relevant. Therefore, the request is considered not associated with a threat level and the risk score is not affected.
2
The Security Analytics Engine compares the username and IP address against the SonicWALL records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with the specified application threat level(s) during that time frame), the request is not considered associated with the configured application threat level(s) and the risk score is not affected.
3
If this check returns as true (there is a record associated within the configured threat level(s) that fits all the parameters), the request is considered associated with the configured application threat level(s) and the risk score is increased.

Associated w/ Blacklist

* 
NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.
* 
NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.
Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with a blacklist. The following parameters are available:
Table 10. Associated w/ Blacklist parameters
Parameter
Description
Associated default condition
Identifier
Enter a name for the condition.
Associated w/ Blacklist (Default)
Description
Enter a description for the condition.
Blacklist association detected for the user or IP address.
Days To Check
The number of days to check for blacklist association. A maximum of 365 days can be checked.
7
Minimum Count
The minimum number of times activity associated with a blacklist has been detected per day. This must be a value between 1-9999.
1
Minimum Days
The minimum number of days that meet the Minimum Count criteria. A maximum of 365 days can be entered. The number of days entered must be equal to or lower than the Days To Check parameter.
1
Use Blacklist Type(s)
Select the blacklist(s) to use:
•
All lists
•
Dell SecureWorks
•
Custom text list(s)
All Lists
Checking for blacklist association
The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for a blacklist association.
How the Security Analytics Engine checks for blacklist association
1
A user attempts to access an application that uses an Associated w/ Blacklist condition type to check if the username or IP address is associated with a blacklist.
* 
NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking the selected blacklists is not relevant. Therefore, the request is considered not associated with a blacklist and the risk score is not affected.
2
The Security Analytics Engine compares the username and IP address against the SonicWALL records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with a blacklist during that time frame), the request is not considered associated with a blacklist and the risk score is not affected.
3
If this check returns as true (there is a record associated with a blacklist that fits all the parameters), the request is considered associated with a blacklist and the risk score is increased.

Associated w/ Country

* 
NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.
* 
NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.
Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with malware in a specified country. The following parameters are available:
Table 11. Associated w/ Country parameters
Parameter
Description
Associated default condition
Identifier
Enter a name for the condition.
Associated w/ Country (Default)
Description
Enter a description for the condition.
User or IP address identified as being associated with activity in specific countries.
Days To Check
The number of days to check for country association. A maximum of 365 days can be checked.
7
Minimum Count
The minimum number of times activity in a listed country has been detected per day. This must be a value between 1-9999.
1
Minimum Days
The minimum number of days that meet the Minimum Count criteria. A maximum of 365 days can be entered. The number of days entered must be equal to or lower than the Days To Check parameter.
1
Country
From the drop-down list of countries, select the check box for each country that is considered high risk if a user or IP address is associated with activity in the country.
3 item(s) selected - Iran, Islamic Republic of; Sudan; Syrian Arab Republic
NOTE: These countries are from the following list posted by the U.S. Department of State: http://www.state.gov/j/ct/list/c14151.htm
Checking for country association
The following procedure explains how the Security Analytics Engine checks the user and IP address attempting to access an application for an association with activity in a specified country.
How the Security Analytics Engine checks for country association
1
A user attempts to access an application that uses an Associated w/ Country condition type to check if the username or IP address is associated with activity in a specified country.
* 
NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking for country association is not relevant. Therefore, the request is considered not associated with activity and the risk score is not affected.
2
The Security Analytics Engine compares the username and IP address against the records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with activity during that time frame), the request is not considered to come from a user or IP address associated with activity in a specified country and the risk score is not affected.
3
If this check returns as true (there is a record of activity for that username or IP address in that country that fits all the parameters), the request is considered associated with the country and the risk score is increased.

Associated w/ Malware

* 
NOTE: This condition is associated with the SonicWALLPlugin type which requires that the Security Analytics Engine Installer - SonicWALL Processor Service.msi and SonicWALL™ firewall be installed and configured. See the Security Analytics Engine SonicWALL™ Configuration Guide for more information.
* 
NOTE: The SonicWALLPlugin is associated with this condition and provides important settings.
Categorized as a Behavior condition, this type of condition always causes the risk score to increase if the user or IP address is associated with malware. The following parameters are available:
Table 12. Associated w/ Malware parameters
Parameter
Description
Associated default condition
Identifier
Enter a name for the condition.
Associated w/ Malware (Default)
Description
Enter a description for the condition.
User or IP address identified as being associated with malware detection.
Days To Check
The number of days to check for malware association. A maximum of 365 days can be checked.
7
Minimum Count
The minimum number of times malware has been detected. This must be a value between 1-9999.
1
Checking for malware association
The following procedure explains how the Security Analytics Engine checks the username and IP address attempting to access an application for an association with malware.
How the Security Analytics Engine checks for malware association
1
A user attempts to access an application that uses an Associated w/ Malware condition type to check if the username or IP address is associated with malware.
* 
NOTE: If there is no user ID or IP address available, or the IP address is in a configured DynamicNetwork range, checking for malware is not relevant. Therefore, the request is considered not associated with malware and the risk score is not affected.
2
The Security Analytics Engine compares the username and IP address against the malware records that were detected within the specified number of days to check. If this check returns as false (there is no record associated with malware during that time frame), the request is not considered associated with malware and the risk score is not affected.
3
If this check returns as true (there is a record associated with malware that fits all the parameters), the request is considered associated with malware and the risk score is increased.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating