Chat now with support
Chat with Support

Security Analytics Engine 1.1 - Help Desk User Guide

Administration Web Site Overview

•
Introduction
•
Launch the Administration web site
•
Web site components

Introduction

The Security Analytics Engine from Dell™ is used by applications for adaptive authorization. By using risk policies, an application is able to customize their authorization requirements to better minimize the risk of a malicious user gaining access to the application.
In some instances a legitimate user will receive a risk score that blocks their access to an application (for example, due to a business trip outside their normal geographic location). In these cases, the user can contact a help desk operator to get a temporary override.
How the Security Analytics Engine works
When a user attempts to access an application which uses the Security Analytics Engine, they are evaluated by a customizable risk policy to determine the risk of allowing the user access. Each risk policy is made up of conditions and modifiers which have assigned scores. For each access attempt these conditions and their associated modifiers are evaluated individually, and a single risk score is then calculated using all of the condition scores.
For example, a user could log into an application using an abnormal browser while also using a weak method of authentication. The risk policies allow you to take these two types of behavior into account by letting you apply modifiers to conditions in cases where additional circumstances may impact the risk from a triggered condition. The conditions are assigned a condition score and the modifiers are then able to increase or lessen that condition score if they are triggered at the same time. So in this case, by triggering both the abnormal browser condition and its associated weak authentication modifier, the configured condition score is further increased due to the modifier.
A condition can also have no impact on a risk score when triggered if there is a modifier applied which is configured to cancel out the condition score. If the user using an abnormal browser is also on a configured whitelist, the whitelist modifier could be applied to have a zeroing effect on both the condition it is associated with and any other modifiers that are also triggered. Assuming no other conditions are triggered, this would cause a risk score of 0 for the access attempt.
The Security Analytics Engine also allows you to include conditions without modifiers associated with them. For example, the earlier access attempts probably would not be as much of a security threat as someone that logs in from an IP address that is associated with malware. Configuring a risk policy to give the highest risk score to potential malware infected access attempts means that even if the user appears on a whitelist being used as a modifier to negate a different condition they will still receive the highest risk score.
The risk score that is calculated for each access attempt is then sent to the application which uses the risk score to determine whether to allow access, request additional authentication information from the user before allowing access, or deny access. A user may also contact a help desk operator for further assistance if they are unable to access an application due to a high risk score.

Launch the Administration web site

You can access the Security Analytics Engine Administration web site from any computer that has network access to the server.
To launch the Security Analytics Engine Administration web site
* 
NOTE: In order to launch the Security Analytics Engine Administration web site, you must be added to the help desk operator role. If you do not have the correct permissions, contact your Security Analytics Engine Administrator.
1
Open your web browser and enter the URL of the Security Analytics Engine Administration web site:
https://<server>/SecurityAnalyticsEngine
* 
NOTE: Where <server> is the IP address or host name (or ‘localhost’) of the server where the Security Analytics Engine was installed.
2
When the web site is launched, enter your username and password.
3
(Optional) Select the Keep me logged in check box to remain logged in to the Security Analytics Engine Administration web site until the Log Out option is selected.
4
Click Log in.
5
The Home page of the Security Analytics Engine Administration web site appears.

Web site components

The Security Analytics Engine Administration web site consists of the following components allowing you to navigate and use the Security Analytics Engine Administration web site.
•
Heading bar
•
Main web pages
•
Navigating the Administration web site
•
Filter data
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating