The following are a few common scenarios where enabling behavioral analytics helps accelerate threat detection:
Albert works in a Healthcare organization. He browses news sites from his corporate computer. One day, he inadvertently clicks a malicious URL that injects the spyware script in his browser. The script starts accessing numerous sensitive applications and downloading the data.
ArcSight Intelligence identifies a sudden increase in the number of access attempts and network lateral movements from Albert’s system. ArcSight Intelligence classifies this as high risk and shares his risk score, and Privileged Account Manager blocks Albert from accessing any application.
Daniel, a helpdesk engineer, accesses the sensitive data and explores various corporate resources from home at night. ArcSight Intelligence detects the anomalous behavior and classifies Daniel as a high-risk user. ArcSight Intelligence shares the risk score with Privileged Account Manager and it blocks access for Daniel before anything too malicious happens.
Olga, an engineer, is erroneously given access to a privileged application. She decides to browse that application from home on a weekend. ArcSight Intelligence detects this privileged access abuse and increases her risk. Privileged Account Manager blocks Olga’s access to the application
Lucio, a system admin, has access to a service account with higher privileges. He uses that account’s credentials to access the restricted data. ArcSight Intelligence detects the account misuse as high risk and shares this information with Privileged Account Manager and it locks down this service account.
Amrita, an HR professional, forgets to lock her computer. This allows a colleague to probe the sensitive data. ArcSight Intelligence detects this account compromise with medium risk and results in the Privileged Account Manager multi-factor authentication requirement the next day. This stops the colleague from the subsequent attempt to steal the data.
ArcSight Intelligence detects an unusual number of access requests from similar IPs or similar devices. The overall risk is high as the organization might be under a stealth attack or at risk of a DDOS attack.
ArcSight Intelligence detects an increase in the number of identities. It also detects an unusual number of access requests from these identities. ArcSight Intelligence increases the overall risk of this B2C organization as the attackers might be creating an excessive number of identities by using social login. Attackers could also launch a DDOS attack with these valid identities.
Thomas, an engineer, has malware running on his laptop. This malware uses his account to snoop the resources on the network. ArcSight Intelligence detects the infected host by considering unusual access patterns and endpoint threat patterns. ArcSight Intelligence determines the user as high risk. Privileged Account Manager blocks his access