Skip to content

Commit 3aefd12

Browse files
authored
Update product-rule-based-anomalies.md
Added clarity about rule-based anomaly alert triggers. Changed wording from anomaly trigger to alert trigger and updated the headings throughout the page including links to other docs pages. We need to update the title of this page in the learn navigation pane to say "Create and view rule-based anomaly alerts and alert triggers"
1 parent ed94445 commit 3aefd12

File tree

1 file changed

+20
-13
lines changed

1 file changed

+20
-13
lines changed

articles/active-directory/cloud-infrastructure-entitlement-management/product-rule-based-anomalies.md

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Create and view rule-based anomalies and anomaly triggers in Permissions Management
3-
description: How to create and view rule-based anomalies and anomaly triggers in Permissions Management.
2+
title: Create and view rule-based anomaly alerts and alert triggers in Permissions Management
3+
description: How to create and view rule-based anomaly alerts and aalert triggers in Permissions Management.
44
services: active-directory
55
author: jenniferf-skc
66
manager: amycolannino
@@ -12,13 +12,20 @@ ms.date: 02/23/2022
1212
ms.author: jfields
1313
---
1414

15-
# Create and view rule-based anomaly alerts and anomaly triggers
15+
# Create and view rule-based anomaly alerts and alert triggers
1616

17-
Rule-based anomalies identify recent activity in Permissions Management that is determined to be unusual based on explicit rules defined in the activity trigger. The goal of rule-based anomaly is high precision detection.
17+
Rule-based anomalies identify recent activity in Permissions Management that is determined to be unusual based on explicit rules defined in the alert trigger. The goal of rule-based anomaly alerts is high-precision detection.
18+
19+
You can configure rule-based anomaly alert triggers for the following conditions:
20+
- **Any Resource Accessed for the First Time**: The identity accesses a resource for the first time during the specified time interval.
21+
- **Identity Performs a Particular Task for the First Time**: The identity does a specific task for the first time during the specified time interval.
22+
- **Identity Performs a Task for the First Time**: The identity performs any task for the first time during the specified time interval.
23+
24+
Alert triggers are based on data collected. All alerts, if triggered, are shown every hour under the Alerts subtab.
1825

1926
## View rule-based anomaly alerts
2027

21-
1. In the Permissions Management home page, select **Activity triggers** (the bell icon).
28+
1. In the Permissions Management home page, select **Alerts** (the bell icon).
2229
1. Select **Rule-Based Anomaly**, and then select the **Alerts** subtab.
2330

2431
The **Alerts** subtab displays the following information:
@@ -49,11 +56,11 @@ Rule-based anomalies identify recent activity in Permissions Management that is
4956
- **Details**: Displays details about **Authorization System Type**, **Authorization Systems**, **Resources**, **Tasks**, **Identities**, and **Activity**
5057
- **Activity**: Displays details about the **Identity Name**, **Resource Name**, **Task Name**, **Date/Time**, **Inactive For**, and **IP Address**. Selecting the "eye" icon displays the **Raw Events Summary**
5158

52-
## Create a rule-based anomaly trigger
59+
## Create a rule-based anomaly alert trigger
5360

54-
1. In the Permissions Management home page, select **Activity triggers** (the bell icon).
61+
1. In the Permissions Management home page, select **Alerts** (the bell icon).
5562
1. Select **Rule-Based Anomaly**, and then select the **Alerts** subtab.
56-
1. Select **Create Anomaly Trigger**.
63+
1. Select **Create Alert Trigger**.
5764

5865
1. In the **Alert Name** box, enter a name for the alert.
5966
1. Select the **Authorization System**, **AWS**, **Azure**, or **GCP**.
@@ -72,9 +79,9 @@ Rule-based anomalies identify recent activity in Permissions Management that is
7279
1. On the **Configuration** tab, to update the **Time Interval**, select **90 Days**, **60 Days**, or **30 Days** from the **Time range** dropdown.
7380
1. Select **Save**.
7481

75-
## View a rule-based anomaly trigger
82+
## View a rule-based anomaly alert trigger
7683

77-
1. In the Permissions Management home page, select **Activity triggers** (the bell icon).
84+
1. In the Permissions Management home page, select **Alerts** (the bell icon).
7885
1. Select **Rule-Based Anomaly**, and then select the **Alert Triggers** subtab.
7986

8087
The **Alert Triggers** subtab displays the following information:
@@ -113,7 +120,7 @@ Rule-based anomalies identify recent activity in Permissions Management that is
113120

114121
## Next steps
115122

116-
- For an overview on activity triggers, see [View information about activity triggers](ui-triggers.md).
123+
- For an overview on alerts and alert triggers, see [View information about alerts and alert triggers](ui-triggers.md).
117124
- For information on activity alerts and alert triggers, see [Create and view activity alerts and alert triggers](how-to-create-alert-trigger.md).
118-
- For information on finding outliers in identity's behavior, see [Create and view statistical anomalies and anomaly triggers](product-statistical-anomalies.md).
119-
- For information on permission analytics triggers, see [Create and view permission analytics triggers](product-permission-analytics.md).
125+
- For information on finding outliers in identity's behavior, see [Create and view statistical anomaly alerts and alert triggers](product-statistical-anomalies.md).
126+
- For information on permission analytics alerts and alert triggers, see [Create and view permission analytics alerts and alert triggers](product-permission-analytics.md).

0 commit comments

Comments
 (0)