Security Analytics Engine 1.1 - Help Desk User Guide

Chat now with support

Filtering the audit events Displaying details for an individual audit event Downloading audit events information Adding and managing overrides on the Auditing page

Adding a policy override Managing a policy override

Issued Alerts

Introduction Issued Alerts page

Filtering options Issued Alerts table

Filtering the issued alerts

Policy Overrides

Introduction Policy Overrides page Managing overrides on the Policy Overrides page

Introduction

From the Home page of the Administration web site, click on the Policy Overrides link to open the Policy Overrides page where you can view and manage all policy overrides that are currently in effect.

Policy Overrides page

This page allows you to view and manage override policies.

The following information and buttons are displayed for each policy override:

User Name

The name of the user to whom the override applies.

User Address

The IP address of the user to which the override applies. This column appears blank if no user address is specified in the override.

Browser ID

The browser ID to which the override applies. This column appears blank if no browser ID is specified in the override.

Expiration

The date and time that the policy override expires. Once this date and time has been reached, the override will no longer appear in the list and the user will again be evaluated according to an application’s risk policy. The date and time are displayed according to the local time zone.

Countdown

Displays the time left before the override expires. Refresh the page to update the countdown.

Last Updated By

The username of the administrator or help desk operator that last created or edited the override.

Edit

Click this button to edit the selected override.

The following button appears at the bottom of the Policy Overrides page:

Delete Selected Overrides

Click this button to delete selected overrides. Once an override is deleted it will no longer be in effect for the user.

Managing overrides on the Policy Overrides page


	NOTE: Policy overrides must first be created on the Auditing page by selecting specific audit events. See Auditing page for more information.


	NOTE: In cases where overrides have been disabled for a risk policy, the risk score will always be reported regardless of whether or not there is an override in place for the user.


	IMPORTANT: Since adding an override causes the Security Analytics Engine to return a risk score of 0, alerts will not be sent for the user until the override has expired.

Managing a policy override

To edit a policy override

From the Home page, click Policy Override.

Select the override to edit and click Edit to open the Modify Override dialog. For information on locating a specific override, see To filter data.

The following information is displayed for the override:

•

Last Updated By: <nn> - The username of the administrator or help desk operator that last created or modified the override.


	NOTE: This field cannot be edited.

•

User Name - The name of the user to whom the override applies.


	NOTE: This field cannot be edited.

•

Browser ID - The browser ID to which the override applies.

•

User Address - The IP address to which the override applies.

•

Expires In - The time left before the override expires. The override must last a minimum of 30 minutes.

Click the Save button to save the changes to the override and close the dialog. The changes to the override are now in effect and alerting is still stopped for the user the specified expiration time.

To delete a policy override

From the Home page, click Policy Override.

On the Policy Override page, use one of the following methods to delete a policy override:

•

Click the Edit button associated with the override to open the Modify Override dialog. Click the Delete button.

•

Select an override from the table, then click the Delete Selected Overrides button.