Balabit Privileged Account Analytics
Overview
Details
Privileged Account Analytics contains 13 algorithms which are continuously analyzing 17 behavioral characteristics, including:
• Time of login
• Activity type
• Used host
• Issued commands
• Window title (used application)
• Keystroke dynamics
• Mouse movement dynamics
The Balabit PAA Splunk App consists of 3 dashboards providing distinct views: the overview dashboard, the user profile dashboard and the detailed session analytics dashboard.
• The overview dashboard’s purpose is to give a general, high level overview over the sessions recorded by Balabit PSM and analyzed by Balabit PAA. It contains aggregated counters of sessions, line charts showing trends, maximum score values over time, as well as a table showing sessions in the selected time period. It builds on data that is constantly being updated, in near real-time.
• The user profile dashboard shows the behavioral profile or baseline of individual users. It is fed by the balabit_profiles index, and shows various information, including:
• Name of user
• LDAP/Windows AD groups the user is a member of
• Login time probability distribution
• Hosts most frequently accessed
• Commands that have been most frequently issued by the user
• Window titles that have been most often observed in the user’s RDP sessions
• The detailed session analytics dashboard shows detailed information about a single selected session only, including not only general information about the session, but the aggregated risk score and individual algorithm scores as well.
Customers can customize Balabit PAA to their specific needs by fine-tuning the algorithms.
Release Notes
Version 1.0.1
New icons for the application