Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Security Analytics Engine 1.1 - User Guide

Table of Contents

Security Analytics Engine Overview

Introduction Launch the Security Analytics Engine Administration web site Web site components

Heading bar Main web pages Navigating the Security Analytics Engine Administration web site Filter data

Introduction Plugins page Plugins

BlacklistProviderPlugin BuiltinPlugin GeoLocationPlugin LdapPlugin SonicWALLPlugin

Editing plugins

Introduction Conditions page Condition categories

Abnormal Browser

Abnormal Authentication Abnormal Time Associated w/ Application Category Associated w/ Application Threat Level Associated w/ Blacklist Associated w/ Country Associated w/ Malware Authentication List

Abnormal Location Country List

Dynamic Blacklist Network List

Role List Last Logon LDAP Group

Adding and managing conditions

Creating a new condition Managing conditions

Shared Policies

Introduction Shared risk policies Shared Policies page Adding and managing shared risk policies

Adding a new shared risk policy Managing shared risk policies

Shared Policy wizard

Introduction Risk policies Applications page

Sample Application

Adding and managing applications

Adding a new application Managing applications

Adding and managing risk policies

Adding a new risk policy Managing risk policies Managing shared risk policies in an application

Application wizard

Introduction Auditing page

Filtering options Retention settings option Audit Events table Event details Download options

Filtering the audit events Configuring the retention settings Displaying details for an individual audit event Downloading audit events information Adding and managing overrides on the Auditing page

Adding a policy override Managing a policy override

Introduction Issued Alerts page

Filtering options Issued Alerts table

Filtering the issued alerts

Policy Overrides

Introduction Policy Overrides page Managing overrides on the Policy Overrides page

Fallback Password

Introduction Fallback Administrator Password page

Security Settings

Introduction Security wizard

Adding new authentication providers

Security wizard pages

Glossary

Notification emails sent when a certain score is exceeded for a risk policy. Multiple alerts can be configured for a single application. Alerts can be sent with information regarding a risk score for an access attempt and with additional information after an access attempt has been authorized.

An external program that is configured to receive and interpret a risk score from the Security Analytics Engine.

Used to define how a risk policy will utilize the data within plugins. Multiple conditions are combined to create a risk policy. Within a risk policy, conditions are assigned a score which contributes to the risk score.

Condition Score

This refers to the score a condition and its associated modifiers create when triggered. A condition score is combined with all other condition scores to determine a risk score for the access attempt.

Fallback Account

This is the primary administration account for the Security Analytics Engine that is created when the Security Analytics Engine Administration web site is first accessed. Through the use of a separate login screen, the fallback account provides complete access to the Security Analytics Engine Administration web site.

A condition used in a risk policy to modify another condition. A modifier with a value below 100% will decrease a condition score when triggered, while a modifier with a value over 100% will increase a condition score when triggered.

Set by a Security Analytics Engine Administrator or Help Desk Operator, this bypasses policy evaluation for a user for a specified period of time. A risk score of 0 is returned for the duration of the override.

Used for retrieving and storing the data used by the Security Analytics Engine. The Security Analytics Engine uses conditions to determine how an application uses the information stored in each plugin.

A set of conditions and modifiers that determine the risk score of an access attempt. Risk policies can also be configured that send alerts when specific conditions are triggered during an access attempt.

The sum of the triggered condition scores within a risk policy. The risk score is the value between 0-100% that the Security Analytics Engine returns to an application so that it can determine how to proceed with an access attempt.

Shared Risk Policy

A risk policy that is available for use by all applications without having to recreate the risk policy for each application.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2025 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center