Security Analytics Engine 1.1

Can decrease risk - Selecting this option will cause the condition score to decrease if the access attempt comes from a listed role. A condition with this setting can only be used as a modifier in a risk policy.

•

Can both increase or decrease risk - Selecting this check box will allow you to configure the risk score to either increase or decrease.

NOTE: In order to avoid application configuration errors, this parameter cannot be edited once the condition has been saved.

Can increase risk

Role Definitions

The following field and buttons appear in this section:

Role

Enter the name of an application specific role to check the user against.

•

Admin

•

Helpdesk

Delete

Click this button to remove the corresponding role from the list of role definitions.

N/A

Add

Click to add additional roles to the list.

N/A

Checking for application roles

The following procedure explains how the Security Analytics Engine checks if the user belongs to the specified role(s).

How the Security Analytics Engine checks application roles

A user attempts to access an application that uses a Role List condition type to determine if the user belongs to any application specific roles.

The Security Analytics Engine checks if this access attempt is from a specified role. If this check returns as false (the account is not in a specified role or has no assigned roles), the risk score is not affected.


	NOTE: In cases where a user has multiple roles, each role is checked to see if it corresponds with any of the roles specified in the Application Roles condition.

If the check returns as true (the account is in a specified role), the risk score is affected.

Last Logon


	NOTE: The LdapPlugin is associated with this condition and provides important settings.

Categorized as a User condition, this type of condition always causes the risk score to increase if the user has not logged in within the specified number of days. The following parameters are available:

Table 22. Last Logon parameters
Parameter	Description	Associated default condition
Identifier	Enter a name for the condition.	Last Login (Default)
Description	Enter a description for the condition.	Active Directory® user account has not logged in within a set number of days.
Days To Check	The number of days to check for the Active Directory user. A maximum of 365 days can be checked. The minimum number of days is dependent upon the ms-DS-Logon-Time-Sync-Interval attribute which controls how frequently the domain updates the data which is then utilized by the LdapPlugin. By default this domain attribute is set to 14 days, in which case the value entered into this field would need to be between 14-365 days. If necessary, previously created conditions will automatically update to be within the acceptable range should the domain attribute be reconfigured. NOTE: Entering 0 will disable this parameter as long as the Include Never Logged On check box is selected. If the Include Never Logged On check box is cleared, there must be a valid value entered into this field.	30
Include Never Logged On	Select this check box to consider users that have never before logged on to have failed the Days to Check parameter. NOTE: This check box must be selected if the Days To Check parameter is set to 0.	(Selected)

Checking an Active Directory account for last logon activity

The following procedure explains how the Security Analytics Engine checks if the Active Directory user logged in within the set number of days.

How the Security Analytics Engine checks an Active Directory account for last logon activity

An Active Directory user attempts to access an application that uses a Last Logon condition type to determine if the account has logged in within the set number of days.

The Security Analytics Engine checks if this access attempt is from an account that has logged on within the specified time period. If this check returns as false (the account has logged in within the time period), the risk score is not affected.

If the check returns as true (the account has not logged in within the time period), the risk score is affected.


	NOTE: If the Include Never Logged On check box is selected, a first time login for an Active Directory user account will automatically return true.

LDAP Group


	NOTE: The LdapPlugin is associated with this condition and provides important settings.

Categorized as a User condition, this type of condition determines if the request originates from a user belonging to a certain LDAP Group in order to increase/decrease protection for accounts of certain groups. The following parameters are available:

Table 23. LDAP Group parameters

Parameter

Description

Associated default condition

Identifier

Enter a name for the condition.

LDAP Group (Default)

Description

Enter a description for the condition.

User identified as belonging to a certain LDAP group.

Risk Type Value

Select the impact the condition will have on the risk score:

•

Can increase risk - Selecting this option will cause the risk score to increase if the access attempt comes from a listed group.

•

Can decrease risk - Selecting this option will cause the condition score to decrease if the access attempt comes from a listed group. A condition with this setting can only be used as a modifier in a risk policy.

•

Can both increase or decrease risk - Selecting this check box will allow you to configure the risk score to either increase or decrease.

NOTE: In order to avoid application configuration errors, this parameter cannot be edited once the condition has been saved.

Can increase risk

Ldap Groups

The following field and buttons appear in this section:

Group Name

Select the LDAP group name(s) from the drop-down menu to test for membership.

(Default LDAP groups are dependent upon on the groups currently available in the domain)

Delete

Click this button to remove the corresponding LDAP group from the list.

N/A