Overview

Log360 is a unified SIEM solution with integrated DLP and CASB capabilities to detect, investigate, and respond to security threats. The UEBA capability is powered by machine learning and can detect anomalies in the behavior of users and entities in a network. There are three types of anomalies that it looks for:

a. Time anomaly: This occurs when a user performs an activity, or an entity has an activity performed on it, at a time that falls outside an expected range.

b. Count anomaly: This occurs when the number of activities performed by a user or performed on a host exceeds an expected threshold.

c. Pattern anomaly: This occurs when an unexpected sequence of events happens together.

Based on the extent of the anomalies, an overall risk score is calculated for every user and host. For users, this overall risk score is further divided into four sub-risk scores: the insider threat risk that a user poses, data exfiltration, logon anomalies, and compromised accounts. A timeline of the user’s anomalous activity can also be easily viewed to understand what took place.

Seasonality factors and dynamic peer group analysis are used for better risk scoring in Log360. While seasonality enables you to disregard expected seasonal behavior deviations while calculating risk, peer group analysis enables you to get the overall context of how a particular user’s behavior compares to other members within their peer group. You can also customize risk scoring by defining the list of anomalous activities that need to be considered, the importance of each anomalous activity, and the time decay factor (the time it takes for a risk score to gradually fall back to zero).

Log360 enables you to set up alerts based on:

1) Discrete anomalous occurrences within the network.
2) Risk thresholds defined by your organization’s risk appetite.