With the Lepide Solution, you can identify single point anomalies to gain an understanding of when users are doing something that is outside of their normal behavior. The UEBA analysis within the Lepide Data Security Platform allows you to determine exactly why something has been flagged as unusual based upon a number of factors including, time, event criticality, operation, and location.

User behavior is analyzed based upon a predefined learning period to accurately identify potential insider threats.

1. How to Configure Anomaly Analysis (UEBA)

From the Component screen:

• Click the Settings icon

  

• Choose UEBA from the tree structure on the left-hand side

The following screen will be displayed:

The top area of the screen shows Added Components.

• Add components here to learn the user behavior for anomaly analysis

• You can specify here where you want anomaly alerts to be sent. One or more of the following options can be selected: Email, Live Feed and Mobile App

• To Add a new component, click the

  

  icon to the top right of the screen

The middle area of the screen shows Domain Management.

• Add a domain here to find the list of users for which the learning has to start. Once a domain has been added it will be scanned every 24 hours to fetch the newly created users.

• Right click on the domain to do a manual scan at any point in time.

• To add a new domain, click the

  

  icon

The bottom of the screen shows User Management.

All the users of the selected domain will be listed here.

The start date of learning will be shown for each user together with the OU Path and the Learning Stage.

1.2 Learning Stages

The Learning Stages are called Infancy, Childhood, Adolescence and Adulthood and these are based on the number of days specified in the learning duration which is found under the settings icon at the top right of the screen. To specify the Learning Duration:

• Click the settings icon

  

  and choose Learning Duration

The Learning Duration dialog box is displayed:

• Specify the number of days over which the learning should take place. It is recommended that this is at least 3 months (90 days) but it can be any number up to 180 days.

• Click OK

The Learning Stages (Infancy, Childhood, Adolescence and Adulthood) are calculated based on the Learning Duration. The number of days is divided by 4 to determine each of the four learning stages. For example, if the Learning Duration was set to 80 days, then each of the learning stages would be 20 days.

1.2 Learning Information

From the UEBA screen, click on the learning stage for a particular user to find the Learning Information details for that user by component:

This shows the learning information for the user Adam. The learning stage for both the File Server and Active Directory components is Adulthood. These could be at different learning stages if the components had been installed at different times.

1.3 Reset or Extend Learning

• From the UEBA Screen, right click on a username for more options:

These options are to:

• Reset Learning to start the learning again for that user

• Extend Learning to increase the number of days of learning for that user

2. How to Report on Anomalies

Once anomaly analysis has been configured it needs to run for enough time for the Solution to be able to spot anomalous behavior. It will start finding anomalies immediately, but the longer it runs the better as it will be able to establish a pattern of normal user behavior and then spot anything unusual and flag it as an anomaly.

The Anomaly Analysis Report

The Anomaly Analysis Report identifies any anomalous behavior for a particular time-period. The report is generated as follows:

• Click the User Entity & Analytics icon

  

  to display the States & Behavior window

A list of reports is displayed in a tree structure on the left-hand side of the screen

• Click on Anomaly Analysis and the report will be displayed:

From the top of the screen, set the filters as follows:

• Click Component to select the components required or leave as all

• Click Analysis Period to select a date range for the report

• Click User to select the users required or leave as all

• Click Analyze

The report will run and will display anomalies for the selected components, the specified time period and selected users:

• To see anomalies for a specific user, click on the username from the list of users in the middle section of the screen:

• In the example above, the user Paul has been selected and a graph shows a graphical representation of all anomalies for Paul

• Pausing on any of the points of the graph will show more information about the anomalies:

• Below the graph is a list of all the anomalies for the selected user (Paul) showing Date, Time and Details of the anomaly:

• By clicking on an anomaly in this list, you can see details of the selected anomaly in the Anomaly Details window to the right:

• In the example above we have clicked on the first anomaly in the list which showed that the permissions of 23 files had been changed. The Anomaly Details window on the right shows more details about the files which were changed including the filename and path, operation, process name, from which server, severity and when it happened.