Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Security Analytics Engine 1.2 - User Guide

Table of Contents

Security Analytics Engine Overview

Introduction to the Security Analytics Engine

How the Security Analytics Engine works

Launch the Administration web site (fallback) Web site components

Heading bar Main web pages Navigating the Administration web site Filtering data on the Administration web site

Introduction to plugins Plugins page Available plugins BlacklistProviderPlugin

BlacklistProviderPlugin Configuration BlacklistProviderPlugin Condition

BuiltinPlugin Configuration BuiltinPlugin Conditions

GeoLocationPlugin

GeoLocationPlugin Configuration GeoLocationPlugin Conditions

LdapPlugin Configuration LdapPlugin Conditions

SonicWALLPlugin

SonicWALLPlugin Configuration SonicWALLPlugin Conditions

Editing a plugin

Introduction to conditions Conditions page Condition categories

Abnormal Browser

Abnormal Authentication Abnormal Time Associated w/ Application Category Associated w/ Application Threat Level Associated w/ Blacklist Associated w/ Country Associated w/ Malware Authentication List

Abnormal Location Country List

Dynamic Blacklist Network List

Role List Last Logon LDAP Group

Adding and managing conditions

Viewing a condition Creating a new condition Editing a condition Deleting a condition

Shared Policies

Introduction to shared risk policies Shared risk policies Shared Policies page Adding and managing shared risk policies

Adding a new shared risk policy Editing a shared risk policy Deleting a shared risk policy

Shared Policy wizard

Introduction to applications Risk policies Applications page

Sample Application

Adding and managing applications

Adding a new application Editing an application Deleting an application

Adding and managing risk policies

Adding a new risk policy Duplicating a risk policy Editing a risk policy Deleting a risk policy

Adding and managing shared risk policies in an application

Adding a shared risk policy to an application Duplicating a shared risk policy in an application Deleting a shared risk policy from an application

Application wizard

Introduction to auditing Auditing page

Filtering options Retention settings option Audit Events table Event details Download options

Filtering the audit events Configuring the retention settings Displaying details for an individual audit event Downloading audit events information Adding and managing overrides on the Auditing page

Adding a policy override Editing a policy override on the Auditing page Deleting a policy override on the Auditing page

Introduction to issued alerts Issued Alerts page

Filtering options on the Issued Alerts page Issued Alerts table

Filtering the issued alerts

Policy Overrides

Introduction to overrides Policy Overrides page Managing overrides on the Policy Overrides page

Editing a policy override on the Policy Overrides page Deleting a policy override on the Policy Overrides page

Fallback Password

Introduction to the fallback password Fallback Administrator Password page

Creating a new condition

Conditions > Adding and managing conditions > Creating a new condition

To create a new condition

On the Conditions page, select a condition of the same type and click the button to create a duplicate of that condition.
On the Edit Condition dialog, enter a new name for the condition in the Identifier field.

In the remaining fields, enter settings information for the condition. These fields depend on the type of condition, see Condition categories for more information on the available settings within each type of condition.

NOTE: In order to avoid application configuration errors, the Risk Type Value parameter available for some of the conditions cannot be edited once the condition has been saved. If this parameter must be changed after the condition has been saved, a new condition must be created.

Click Save to save changes and return to the Conditions page.

Editing a condition

Conditions > Adding and managing conditions > Editing a condition

To edit a condition

NOTE: Default conditions cannot be edited.

On the Conditions page, select the condition to edit.

Click the button to open the Edit Condition dialog.

NOTE: In order to avoid application configuration errors, the Risk Type Value parameter available for some of the conditions cannot be edited once the condition has been saved. If this parameter must be changed after the condition has been saved, a new condition must be created. For more information, see To create a new condition.

After making edits, click the Save button to save the changes and close the dialog.

Deleting a condition

Conditions > Adding and managing conditions > Deleting a condition

To delete a condition

NOTE: Default conditions and conditions that are currently used in a risk policy cannot be deleted.

On the Conditions page, select the condition to delete.
Click the button to delete the condition.
A dialog appears confirming that you want to delete the selected condition. Click the Delete button.

Shared Policies

Shared Policies

Topics:

Introduction to shared risk policies

Shared risk policies

Shared Policies page

Adding and managing shared risk policies

Shared Policy wizard

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center