View Details for the Most Risky Users
Table of Contents
View Details for the Most Risky Users
Get visibility into the most risky users on your tenant, based on the number and
severity of threat incidents logged by Behavior Threats.
Depending on when you first activated and configured Data Security, up to 90 days of
historical user data is available to Behavior Threats. Behavior Threats examines
this historical user data, and, using data-driven machine learning models, assigns a
risk score to each user.
The Behavior Threats dashboard in the Cloud Management Console prominently displays
the
Top 3 Risky Users
and you can also View All
Risky Users
. To determine whether a user poses a threat to your
organization, you can view user details (such as the threat incidents associated
with the user and the user's risk score). You can also view the most risky users for individual policies on the
Policies
tab.View the Most Risky Users
The Behavior Threats dashboard displays the most risky users on your tenant. The
most risky users are those with the highest risk scores for your organization.
Investigate these most risky users to determine if they pose a threat to your
organization.
- Navigate to the Behavior Threats dashboard.
- View theTop 3 Risky Usersinformation on the dashboard, which includes the user's risk score and the number of threat incidents associated with the user.
- View detailsfor each of theTop 3 Risky Users. The details include more information about the threat incidents associated with the user. Investigate any suspicious activity and take action as needed.If you want to monitor a user more closely, you can add them to the watchlist.
- After investigating theTop 3 Risky Users, you canView All Risky Users.View detailsfor these users and take action as needed.
View the Most Risky Users for Individual Policies
The Policies tab on the Behavior Threats dashboard shows the most risky users
for each policy. These risky users are the users with
the highest risk scores who are associated with threat incidents for the
policy.
- Navigate to the Behavior Threats dashboard.
- Navigate toPolicies.You can display the Policies in a grid view or a list view. By default, the policies display in a grid view.
- In thePoliciesgrid, locate the policy that you are interested in and view theTop 3 Risky Usersfor the policy.The displayed information includes the user's risk score and the number of threat incidents associated with the user for the policy.
- View detailsfor each of theTop 3 Risky Users. The details include more information about the threat incidents associated with the user. Investigate any suspicious activity and take action as needed.If you want to monitor a user more closely, you can add them to the watchlist.
- After investigating theTop 3 Risky Users, you canview allrisky users for the policy.View detailsfor these users and take action as needed.