AI Anomaly Detection Reports

AI Anomaly Detection Reports enable you to scan consolidated logs for User and Entity Behavior Analytics (UEBA) (e.g. Flag users that logon outside of their typical working hours). This report is typically used by network administrators that want to scan the archive log database for UEBA anomalies.

How to create an Artificial Intelligence Report

• From the Menu Bar select File | New. The Create New Object View displays.
• From the Create New Object View, expand Reports.
• Expand Report | Artificial Intelligence Reports then select one of the AI Anomaly Detection Reports. The Properties View displays.
• The Properties View contains either 7 or 8 configuration tabs depending on the report type selected.
  • General
  • Logs (Event Logs), Logs (Azure Audit Logs)
  • Explicitly Assigned Logs (Log-Based Reports)
  • Columns
  • Options
  • User Filters
  • Date/Time Range
  • Actions

The Columns Tab

Use this view to configure the columns to check for anomalies. This Tab is not available when creating Template Trigger AI Anomoaly Detection Reports.

• Use the Column definitions controls to add the columns you would like to check for anomalies. If the column is not extracted during log consolidation, add the column then specify the regular expression to extract the attribute's value.'
• Use the Group by drop-down to group entries into their own tables.
• Use the Regular expressions controls to specify the regular expressions to extract attribute values.
• Use the Select distinct count drop-down to specify the required column to check for anomalies.
  Important

  This field is required.
• Use the Query by controls to optimize the SQL WHERE statements.

AI Anomaly Detection Column Definition Properties View

The Options Tab

Use this view to configure the AI machine learning rules.

• Use the Type drop-down so select the machine learning algorithm to apply.

• Use the Column definitions controls to specify the columns to include in the report.
  Note

  The previously assigned Select distict column are automatically added to the 3rd column in the table.
• Use the Sort by drop-down to select the columns to sort by.
• Use the Group by time span to group anomaly periods.

Spike

• Use the Confidence slider to fine tune the anomaly detection confidence.
• Use the Sub type drop-down to determine whether to detect positive or negative anomalies, or both.

Source: Anomaly Side Enumeration

Change Point

• Use the Confidence slider to fine tune the anomaly detection confidence.
• Use the Sub type drop-down to select the martingale used for scoring.

Source: Martingale Type Enumeration

Seasonality

• Use the Threshold slider to fine tune the anomaly detection threshold.
• Use the Sensitivity slider to fine tune the anomaly detection sensitivity.

AI Anomaly Detection Options Properties View

Related Topics

AI Reports

Reports