Dashboards

Autonomous Access provides a simple and intuitive graphical UI displaying the risks detected across your company. This section provides an overview of the available Autonomous Access UIs with your deployment.

A tour of the Risk dashboard

The Autonomous Access displays a sortable list of "anomalous" or risky events discovered during the AI/ML pipeline run on the Risk dashboard. Each event displays a summary of the event with the following information:

User Identifier. The username on the account.
Date of Occurrence. The date the anomalous event occurred.
Risk Score. The risk score associated with the event. A risk score is a combination of the likelihood an anomalous behavior event and/or a known threat is detected. Thus, a risk score of 100 indicates the highest likelihood an access attempt was an anomaly and/or a known threat.
Heuristics. The type of heuristic used in the AI/ML analytics. The heuristic indicates the type of risk threat, such as "Automated User Agent," "Brute Force," "Credential Stuffing," "Impossible Traveller," or "Suspicious IP."
City, Country. The geolocation information for city and country.
Browser Type. The browser type the user was using during the anomalous event.

You can also sort the activity events list by descending risk score (default option), event time, and username.

Figure 1: The Autonomous Access Risk dashboard

auto access activity page

In the right column, the Risk dashboard displays a world map with the number of risky events in each circle. You can click and drag directly on the map to access events in other countries. If you click one of the red numbers, the dashboard displays a summary of risky events and the average risk score associated with those events.

Figure 2: Summary of risky geolocation events

auto access activity numbers

Risk activity detail page

To investigate a particular risk event, click the activity event in the left-hand column. The Activity Detail dashboard displays the specific details of the event including transaction ID, user, risk score, time, location, device, and user agent plus a map of where the activity took place. The Activity Detail dashboard also lists the user’s last five risky authentication attempts and the possible type of heuristic discovered (for example, Credential Stuffing). Any category that differs from normal behavior is marked with "Unusual <category>" (for example, "Unusual City").

Figure 3: Activity detail page

auto access activity detail

Filtering by date range

You can filter the display and risky events in a number of useful ways. If you select the Date filter, you can filter the dashboard to display only certain dates and ranges. The options are:

Today. Display only events occurring today.
This Week. Display only the events occurring this week.
This Month. Display only the events occurring this month.
Custom. Display the events based on your selected calendar date range.

Figure 4: Risk dashboard date filtering

auto access date filtering

Filtering by risk score

The Risk dashboard also supports filtering by risk score range.

Figure 5: Active Page Risk Score Filtering

auto access risk score filtering

Advanced filtering

The Risk dashboard also supports advanced filtering based on attribute type and value as well as heuristic filter. The attributes are derived from the information in the user agent string. The AI/ML pipelines use the heuristics occurring in the selected timeframe.

Use the Advanced Filtering:

On the Risk dashboard, click Filters. You will see a Filters dialog/modal appear.
Under Attribute Filters, click the Feature drop-down list, and select one of the following attributes:
- City. The city where the risky event occurred, for example, Bristol, Singapore.
- Country. The country where the risky event occurred, for example, United States, Singapore, Great Britain.
- Device. The device that may have made the risky action, for example, iPad, Mac, Other.
- Device Type. The device type of the system that made the risky action, for example, Apple, Samsung.
- OS. The operating system of the computer, for example, iOS, Linux, Android.
- OS Version. The operating system version, for example, 10, 11, 14.
- Time of Day. The timestamp of the risk event.
- User Agent. The User-Agent request header lets servers identify the browser and operating system to the web server.
- User ID. The user ID of the account that may have been compromised.
Enter a value for the attribute filter you entered in the previous step.
Click the Risk Reason menu to select one of the following heuristics:
- Anomaly detection. A threat where the user’s location, time of access, operating system version, device model and type, browser version and type differs from normal behavior and context.
- Automated user agent filter. A detected threat where an automated bot is in the user-agent string.
- Brute force prevention. A detected threat where direct users are failing multiple authentication attempts.
- Credential stuffing. A detected threat where an IP address is attempting to access a number of different users in a period of time.
- Impossible traveller filter. A detected threat where an attacker runs multiple authentication attempts from various locations in a short time span, making such travel impossible for a single person.
- Suspicious IP check. A detected threat where a user at an IP address is making many authentication attempts over a period of time.
When done, click Apply. The Risk dashboard displays only those criteria that matches your filter.

Figure 6: Risk dashboard advanced filtering

auto access advanced filtering