Investigate a user - Administrator Guide - Cortex XSIAM - Cortex

Investigate a user - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-13

Notice

If the Identity Threat module is enabled you can open the User Risk View. This view displays insights and profiling information to help you investigate alerts and incidents. Viewing anomalies in the context of baseline behavior facilitates risk assessment and shortens the time you require for making verdicts.

If the Identity Threat module is not enabled you can open the User View. This view displays an overview of the user and information about the user's score and activity.

On the User Risk View, you can take the following actions.

Assess the user's behavior and score.
Review the user's working hours and past alerts.
Analyze the user's behavior over time and compare to their peers with the same asset role.
Star the user to be included in the watchlist.

How to investigate a user

Open the User Risk View or the User View.
Identify a user and select Open User Risk View or Open User Card.
Tip
You can also see a list of all users under Assets → Asset Scores.
Select the timeframe to view the user's details.
Investigate the user.
User Risk View
Review the following sections of the User Risk View. Depending on your permissions, some information might be limited by your scope.
In the left panel, review the overview of the user:
User Score: Displays the score assigned on the last day of the selected time frame and the change in the score for the selected time frame. The score is updated continuously as new alerts are associated with incidents.
Common Locations: Displays the countries from which the user connected most in the past few weeks.
Common UAs: Displays the user agents that the user used most in the past few weeks.
Regular Activity Hours: This data is based on the preceding several weeks and takes into account holidays and seasonality to present an accurate picture.
Review time period based information:
Note
Cortex XSIAM normalizes and displays incident and alert times in your time zone. If you're in a half-hour time zone, the activity in the Normal Activity and the Actual Activity charts is displayed in the whole-hour time slot preceding it. For example, if you're in a UTC +4.5 time zone, the time displayed for the activity will be UTC +4.5, however, the visualization in the Normal Activity and the Actual Activity charts will be in the UTC +4 slot.
Score Trend: Displays a graph based on new incidents created within the selected time frame and updates on past incidents that are still active. The straight line represents the user score, which is based on the scores of the incidents associated with the user.
The bubbles in the graph represent the number of alerts and insights generated on the selected day. Bigger bubbles indicate more alerts and insights, and a possible risk.
Click a bubble to drilldown into a score. The Related Incidents and the Related Alerts and Insights widgets display the incidents, alerts, and insights that contributed to the total score on the selected specific day.
For user with associated asset roles, you can compare the data with other peers with the same asset role. Click Compare To and select an asset role to which you want to compare the data. The dashed line presents the average score for peers with the same asset role as the user, over the same time period.
Hover over a bubble on the dashed line to see the Average score for the selected peer, and a breakdown of the score per endpoint. Click Show x Hosts to see a full breakdown of the score on the Peer Score Breakdown, filtered by the selected asset role. From the Peer Score Breakdown you can select any user name and pivot to additional views for further investigation.
Related Incidents: Displays the incident details for the day selected in the Score Trend graph.
The Status column gives visibility into the reason for the score change. For example, if an incident is resolved, its score will decrease, bringing down the host score.
The Points column displays the risk score that the incident contributed to the host score. The points are calculated according to either Cortex XSIAM SmartScore or Incident Scoring Rules.
Related Alerts and Insights: Displays the timeline of all the detection activities associated with the host for the day selected in the Score Trend graph. The information is grouped into buckets according to MITRE ATT&CK tactics.
To view the details of the alert in the Alert Panel view, click the alert. This enables you to see all the details about the alert in one page.
Actual Activity: Displays details of activity per day. The darker the cells, the more activity took place in that time slot. If there is a dashed frame around the slot, Cortex XSIAM detected uncommon activity in that time slot.
Login Attempts: Displays the details and outcomes of the related login attempts by the user. When you select a day in the Score Trend graph, the information changes to reflect the logins for that day.
Latest Authentication Attempts: Displays the details and outcomes of the related authentication attempts by the user. When you select a day in the Score Trend graph, the information changes to reflect the authentication attempts for that day.
SAAS Logs: Displays Saas logs associated with the user. When you select a day in the Score Trend graph, the information changes to reflect the SAAS Logs for that day.
User View
Review the following sections of the User View. Depending on your permissions, some information might be limited by your scope.
In the left panel, review the overview of the user. The displayed information is aggregated by Cortex XSIAMfrom incidents, Workday, and Active Directory data.
The User Score displays the score that is currently assigned to the user and is updated continuously as new alerts are associated with incidents.
Review time period based information:
Score Trend: Displays a graph based on new incidents created within the selected time frame and updates on past incidents that are still active. The straight line represents the user score, which is based on the scores of the incidents associated with the user.
Select a score to display in the Incidents table the incidents that contributed to the total user score on a specific day.
Related Incidents: Displays the incident details for the day selected in the Score Trend graph.
The Status column gives visibility into the reason for the score change. For example, if an incident is resolved, its score will decrease, bringing down the host score.
The Points column displays the risk score that the incident contributed to the host score. The points are calculated according to either Cortex XSIAM SmartScore or Incident Scoring Rules.
User Associated Insights: Displays all the insights associated with the user filtered.
Top 5 Hosts Logged Into
Top 5 Authentication Target Hosts
Top 5 Authentication Source Hosts
Recent Login
Recent Authentications

Notice

Tip

Note