Autonomous Access provides a simple and intuitive graphical UI displaying the risks detected across your organization. The dashboard displays the risky events specific to the realm that you are in.
This section provides an overview of the available Autonomous Access UIs with your deployment.
On the Risk dashboard, Autonomous Access displays a sortable list of "anomalous" or risky events discovered during the AI/ML pipeline run.
To access the Risk dashboard, from the left navigation pane, navigate to Dashboard > Risk.
Each event displays a summary of the event with the following information:
The username on the account.
Date of Occurrence
The date the anomalous event occurred.
The risk score associated with the event. A risk score is a combination of the likelihood an anomalous behavior event and/or a known threat is detected. Therefore, a risk score of 100 indicates the highest likelihood an access attempt was an anomaly and/or a known threat.
The type of heuristic used in the AI/ML analytics. The heuristic indicates the type of risk threat.
The geolocation information for city and country.
The browser type the user was using during the anomalous event.
You can sort the activity events list by clicking Sort: Risk Score and selecting one of the following:
In the right column, the Risk dashboard displays a world map with the number of risky events in each circle. By default, the dashboard displays all risk scores of 50 and above. You can change this setting by change the risk_score_threshold value in the Risk Configuration. Refer to Configuration.
You can click and drag directly on the map to access events in other countries. If you click one of the red numbers, the dashboard displays a summary of risky events and the average risk score associated with those events.
Risk activity detail page
To investigate a particular risk event, click the activity event in the left-hand column. The Activity Detail modal displays the specific details of the event including transaction ID, user, risk score, time, location, device, and user agent plus a map of where the activity took place.
The modal also lists the user’s last five risky authentication attempts and the possible type of heuristic discovered (for example, Automated User Agent). Any category that differs from normal behavior is marked with "Unusual <category>" (for example, "Unusual City").
Filtering by date range
You can filter the display and risky events in a number of useful ways. If you select the Date filter, you can filter the dashboard to display only certain dates and ranges. The options are:
Today: Display only events occurring today.
This Week: Display only the events occurring this week.
This Month: Display only the events occurring this month.
Custom: Display the events based on your selected calendar date range.
Filtering by risk score
The Risk dashboard supports filtering by risk score range.
The Risk dashboard supports advanced filtering based on attribute type and value as well as heuristic filter. The attributes are derived from the information in the user agent string. The AI/ML pipelines use the heuristics occurring in the selected timeframe.
To use advanced filtering:
On the Risk dashboard, click Filters. A filters dialog/modal appears.
Under Attribute Filters, click the Feature drop-down list, and select one of the following attributes:
The city where the risky event occurred, for example,
The country where the risky event occurred, for example,
The device that may have made the risky action, for example,
The device type of the system that made the risky action, for example,
The operating system of the computer, for example,
The operating system version, for example,
Time of Day
The timestamp of the risk event.
The User-Agent request header lets servers identify the browser and operating system to the web server.
The user ID of the account that may have been compromised.
Enter a value for the attribute filter you created in the previous step.
Click the Risk Reason menu to select one of the following heuristics:
Automated User Agent
A detected threat where an automated bot is in the user-agent string.
A detected threat where direct users are failing multiple authentication attempts.
A detected threat where an IP address is attempting to access a number of different users in a period of time.
A detected threat where an attacker runs multiple authentication attempts from various locations in a short time span, making such travel impossible for a single person.
A detected threat where a user at an IP address is making many authentication attempts over a period of time.
A detected threat where a user at an IP address is making authentication attempts at a different city.
A detected threat where a user at an IP address is making authentication attempts in a different country.
When done, click Apply. The Risk dashboard displays only those criteria that matches your filter.Figure 6. Risk dashboard advanced filtering