Advanced AnalyticsExabeam Advanced Analytics User Guide

Along the top of the home page is a row of counters for the environment that Exabeam is monitoring. The counters are for users, assets, sessions, events, and anomalies. Each counter shows totals for the organization and recent counts (during regular operation, recent means the past 30 days). Take the following image, for example:

The organization has 7.9K employees and 22 have been active recently. These counters refresh automatically every 5 minutes.

The Notable Users list shows the highest scoring session for users whose highest score is at least 90. Only the highest scoring session for a user is represented in the Notable Users list. Even if a user has many sessions with a score of 90 or above, his or her name appears in this list only once.

Clicking the caron at the top right activates a drop-down list for selecting the timeframe for that list: last day, last 2 days, last 3 days, last week, last 1 month, or last 3 month.

The users that are on watchlists are users that the analyst may want to keep an eye on for a time. For example, if an employee’s computer was infected with malware and needed to be monitored to ensure the remediation was effective or if an employee has been given termination notice. Watchlists provide quick visibility into any sessions started by these sets of users, their latest risk scores, any assets they touched, and abnormal activities of which they were a part.

There are two types of watchlists - those that are created out-of-the-box by Exabeam and those that are created by an analyst. Users cannot be added or removed from watchlists generated by Exabeam, though the watchlists themselves can be deleted. Analysts can also create their own watchlists (see “Customizing Watchlists”). Users can be added using a search expression or by importing a list of usernames from a CSV file. They can be removed the same way, or deleted automatically after a configurable period of time.

Customizable Watchlists

Analysts can create their own watchlists - these can be username-based, CSV-based, user label-based, or peer group-based. To create a custom watchlist, click Add A Watchlist at the bottom of the home page, and then select the type of watchlist you wish to create.

The customizable watchlists can be edited by clicking the vertical ellipsis icon in the upper right corner of each watchlist panel. Watchlist can be edited in the following ways:

• Add User – Add users by username, by uploading a CSV file, by user label, or by peer group. You can also set a timeframe, after which the user(s) will be removed from the watchlist. This timeframe is per user, not per watchlist. Users can also be added individually from the User Page.

• Add Asset – Add assets by asset name, by uploading a CSV file, or by IP address.

• Remove User – Remove users either individually or by uploading a CSV file.

• Remove Asset – Remove assets either individually, by uploading a CSV file, or by IP address.

• Edit Watchlist: – This option allows the analyst to edit the name or description of the watchlist.

• Delete Watchlist – The watchlist will be permanently deleted.

Account Lockouts is a list of users who have been locked out of their account within the timeframe selected. Clicking the caron at the top right activates a drop-down list for selecting the timeframe for that list: last day, last 2 days, last 3 days, last week, last 1 month, or last 3 months. The account lockouts that Exabeam has deemed risky are at the top.

The account lockouts that Exabeam has deemed risky are at the top.

The admin drop-down menu can be found in the upper-right corner of any page. From there you can navigate to the Settings, Data Insights, or System Health pages, and visit Starred Session Users without returning to the homepage. The Admin Panel also offers the option to logout or to change your password. At the bottom right is where the current Exabeam build number is located.

The information available in the admin panel is primarily for administrators or Exabeam customer support, but it does give access to models not available elsewhere.

Bookmark Sessions

Starred Sessions is a list of selected sessions that an analyst keeps. The list is a mini-bookmark of sessions that an analyst might want to revisit or show to other analysts. Clicking an employee name in this area opens the same Risk Timeline area.

A starred session remains in this list regardless of time. An analyst can add or remove the session from the list by visiting the Session Timeline Page.