ArcSight Intelligence detects an unusual number of access requests from similar IPs or similar devices. The overall risk is high as the organization might be under a stealth attack or at risk of a DDOS attack.
ArcSight Intelligence detects an increase in the number of identities. It also detects an unusual number of access requests from these identities. ArcSight Intelligence increases the overall risk of this B2C organization as the attackers might be creating an excessive number of identities by using social login. Attackers could also launch a DDOS attack with these valid identities.
Thomas, an engineer, has malware running on his laptop. This malware uses his account to snoop the resources on the network. ArcSight Intelligence detects the infected host by considering unusual access patterns and endpoint threat patterns. ArcSight Intelligence determines the user as high risk. Privileged Account Manager blocks his access