Scenario: Insider Threats Detection

Daniel, a helpdesk engineer, accesses the sensitive data and explores various corporate resources from home at night. ArcSight Intelligence detects the anomalous behavior and classifies Daniel as a high-risk user. ArcSight Intelligence shares the risk score with Privileged Account Manager and it blocks access for Daniel before anything too malicious happens.

Olga, an engineer, is erroneously given access to a privileged application. She decides to browse that application from home on a weekend. ArcSight Intelligence detects this privileged access abuse and increases her risk. Privileged Account Manager blocks Olga’s access to the application

Lucio, a system admin, has access to a service account with higher privileges. He uses that account’s credentials to access the restricted data. ArcSight Intelligence detects the account misuse as high risk and shares this information with Privileged Account Manager and it locks down this service account.