The Insider Threats & Advanced Compromise incidents display the top risky users based on their User Confidence Index. You will access this page to view details for each user.
Important
Basic UBA or UBA standard includes UEBA 9 predefined sequential rules. Advanced UBA includes UEBA ML models, UEBA user scoring with user confidence index (UCI), UCI based inline policies, and Custom UBA sequence rules.
Contact Support to enable this feature in your account, additional licensing is required.
To access this page, click Incidents > Insider Threats & Advanced Compromise.
The Insider Threats & Advanced Compromise incidents show:
Total Users: The total number of users with UCI scores. Click the number of users to view the users in the User Confidence section of the page. This list of users are active users in the last 48 hours (activity window). To change the activity window, select a different timeframe from the dropdown in the upper right corner of the page.
Poor: Total number of users with a Poor User Confidence Index score. Click the number to view details in the User Confidence section of the page.
Moderate: Total number of users with an Moderate User Confidence Index score. Click the number to view details in the User Confidence section of the page.
User Confidence Alert: Click the pencil icon to raise an alert if the user’s UCI drops below a set threshold within 24 hours.
Users active: Select a time range within which users have been active. Choices include: past 48 hours, 7, 30, 60, or 90 days. If you do not see 90 days as an option, contact Support to enable it in your account additional licensing is required.
This is helpful to alert admins when a user’s UCI drops below a certain score to further investigate the user for security concerns. View alert details in Skope IT > Events > Alerts page. Click View Anomalies to see view the anomaly details.
(alert_type in ['uba']) and (alert_name eq 'UCI threshold alert')
You can filter the information that displays in the User Confidence section by:
-
Searching for a user’s name.
-
Severity from the drop-down list:
-
All
-
Poor
-
Medium
-
Good
-
-
A key detection scenario.
-
Multiple nested sub-scenarios.
You can then select a user and view their details on the right.
Click the Sort By Most Recent dropdown to filter the view for the specified user.
Sort By Most Recent: Displays the current information the system has for by the current information the system has for the specified user.
Sort By Score Impact: Displays the most recent user confidence changes for the specific user.
Sort by Date: Click the date to view a calendar and sort by a specific date.
UCI Time box Timeline: A range selector bar allows extending the timeline view for User Confidence Index (UCI) scores to more than the default 14 days. You can view up to 90 days of UCI scores for the selected user. This allows investigating historical UCI score trends and related anomalies for a user.
Key Detection Scenario
The Key Detection Scenario is the single largest type of security risk a user currently represents which contributes to the UCI score dropping. Each anomaly (scenario and sub-scenario combination) are listed individually below and can be sorted by Most Recent, Score Impact, or date. However, the single largest anomaly (scenario and sub-scenario combination) is listed at the top as the Key Detection Scenario for the specified user.
Click the Key Detection Scenario and the Insider Threats & Advanced Compromise policy displays with the pre-selected scenario filters. From this page, admins can view different policies based on the scenario filter. This view helps to assess the users current insider risk.
There are 3 top level categories for key detection scenarios that you can filter. Nested beneath each scenario are an additional 30 granular sub-scenarios that further categorize the user’s risky behaviors.
-
Compromised credential
- Unusual user activity
- Data movement
- Sensitive data movement
- Data destruction
- Resource destruction
- Private app data movement
- Credential exposure
- Application discovery
- Strange access
- Unauthorized operation
-
Compromised device
- Malicious site
- Ransomware
- Network Traffic Violation
- Third party
- Application discovery
- Malware
- Private app discovery
- Unusual application
- Encrypted data movement
- Command and control
-
Insider threat
- Data movement
- Sensitive data movement
- Data destruction
- Unusual endpoint activity
- Unusual Oauth grant
- Resource destruction
- Private app data movement
- Encrypted data movement
- DLP violation
- Unusual admin activity
- Private app discovery
- Unusual cloud application
- Strange access
- Unauthorized operation
Click the pop-out icon at the end of the user details to open the Incidents > Users page. See the Behavior Analytics Incident Details topic for tab details.
