Anomalies
-
- Last UpdatedNov 06, 2024
- 3 minute read
Data Risk Analytics detects anomalous activity based on a baseline learned from the audit data it receives. If the activity is suspicious, but not enough to deem an incident, it is displayed in the Open Anomalies page. You can then perform all actions available for incidents (e.g. investigate, star, search, filter, etc.) except for Allow List rules.
An anomaly, in contrast to an incident, is a suspicious activity that is not categorized by severity. It is another piece of information that can be attributed to an employee, and in conjunction with their incidents, lets you asses the risk they might pose.
The Open Anomalies page aggregates all detected suspicious activities in table format. It shows general details on each open anomaly.
General details shown for each anomaly include:
Anomaly Details
Field | Description |
|---|---|
ID |
The ID number assigned by Data Risk Analytics to the anomaly. |
Type |
The specific anomaly type detected (e.g. Excessive Database Record Access). |
Event Time |
The time and date the event occurred. |
User Name |
The name of the user that performed the suspicious activity. The user name type can be:
|
Source Host |
The host name and IP address of the machine from which the suspicious activity originated. |
Destination |
Depending on the type of server to which the suspicious activity was intended, the following details are shown:
The destination server type can be:
|
Comment |
The comment that was entered in the Anomaly Details page. |
- Single user
- Multiple users
- Single database (including IBM DB2 for z/OS standalone subsystem)
- Multiple databases
- Clustered Databases (currently supporting only IBM for z/OS data sharing group and MongoDB)
- File ServerWhen you click on an anomaly in the table, you are shown a more comprehensive details page about the anomaly. In addition to the details, you can perform all actions available for incidents, except Allow List rules.
Comprehensive details include:
Comprehensive Anomaly Details