Back
Enterprise Secure Access
CDNetworks Documentation Enterprise Secure Access Operation Guide Risk Awareness

Risk Awareness

Last update：2023-07-25 19:34:53

1. Usage Scenario

The risk awareness report displays the high-risk threat trends for enterprise users. IT administrators can quickly understand threat event rankings, high-risk user rankings, high-risk client rankings, and other information from the report in order to quickly grasp the threat activities in the system.

This report is only applicable to customers who has purchased Business licenses.

2. Operation Steps

Go to Console–>Analysis–>Risk Awareness. You will see two tabs: Analysis and Event.

1） In Analysis tab, you will get threat reports based on user behavior analyze, inluding:

[New Feature] WAF Rule Template

Field Name Explanation
High Risk User Trend
Display the trend of the number of users with "Poor" trust level in query time
By Trust Score
Display the top 10 users by their lowest trust score in query time
Threat Event Trend Display the trend of the number of threat events in query time
Threat Event Statistics Display the number and proportion of threat events in query time
High Risk User Top10 Display the top 10 users by the number of threat events or the total threats in query time
High Risk IP Top10 Display the top 10 client login IPs by the number of threat events in query time
High Risk Client Top10
Display the top 10 clients by the number of threat events in query time

2） In Event tab, you will see the threat events been detected, including:
[New Feature] WAF Rule Template

Field Name
 Explanation
Check Time
 Threat event's detection time
Event Time
 Threat event's occurrence time
Username
 Username associated with the threat event
Threat Name
 Name of the threat event
Threat Score
 Threat value of the threat event
Threat Level
 Threat level of the threat event, categorized as high risk, medium risk, and low risk
Threat Status
Stauts of threat events. Available status: Revoked and Not Revoked.
By default, a threat even will be marked as Not Revoked status, meaning the event has not been decided whether it is a threat event and the it is threat level. It will changed to Revoked when:
1) The threat event has reached auto revoke time (1440 min by default), the system revokes the event automatically
2) Administrator manually revoke the event. 
Administrators can manually revoke, confirm or ignore the event from list.
Alert Result The status of how administrator handle the event, available value includes: Ignored, Not Confirmed and Confirmed. The result will change when you do operation in Action field. 
Action
From the list, you can do operation to the threat event, including: 
Confirm: after operation, the event will be confirmed as a threat. And the Alert Result will be changed to "Confirmed"
Ignore: after operation, the event will be ignored. And the Alert Result will be changed to "Ignored".  For threat events detected by the baseline module, the ignore operation add the record to baseline. In the future, the redetection of the record will longer be reported as threat events.
Revoke: after operation, the event will be revoked, the trust scores deducted from the user due to this event will be restored. And the Alert Result of the event will be changed to "Revoked". 

By pressing > icon, you will find more details about the event
[New Feature] WAF Rule Template

Is the content of this document helpful to you?
Yes
I have suggestion
Submitted successfully! Thank you very much for your feedback, we will continue to strive to do better!

CDNetworks Inc., © 2022. 1550 Valley Vista Dr., Suite 110, Diamond Bar, CA 91765 - All rights reserved.