You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-infrastructure-entitlement-management/product-statistical-anomalies.md
+22-12Lines changed: 22 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Create and view statistical anomalies and anomaly triggers in Permissions Management
3
-
description: How to create and view statistical anomalies and anomaly triggers in the Statistical Anomaly tab in Permissions Management.
2
+
title: Create and view statistical anomaly alerts and alert triggers in Permissions Management
3
+
description: How to create and view statistical anomaly alerts and alert triggers in the Statistical Anomaly tab in Permissions Management.
4
4
services: active-directory
5
5
author: jenniferf-skc
6
6
manager: amycolannino
@@ -12,13 +12,23 @@ ms.date: 02/23/2022
12
12
ms.author: jfields
13
13
---
14
14
15
-
# Create and view statistical anomalies and anomaly triggers
15
+
# Create and view statistical anomaly alerts and alert triggers
16
16
17
-
Statistical anomalies can detect outliers in an identity's behavior if recent activity is determined to be unusual based on models defined in an activity trigger. The goal of this anomaly trigger is a high recall rate.
17
+
Statistical anomalies can detect outliers in an identity's behavior if the recent activity is determined to be unusual based on models defined in an activity trigger. The goal of this alert trigger is a high recall rate.
18
+
19
+
You can configure statistical anomaly alert triggers for the following scenarios:
20
+
-**Identity Performed High Number of Tasks**: The identity performs higher than their usual volume of tasks. For example, an identity typically performs 25 tasks per day, and now it is performing 100 tasks per day.
21
+
-**Identity Performed Low Number of Tasks**: The identity performs lower than their usual volume of tasks. For example, an identity typically performs 100 tasks per day, and now it is performing 25 tasks per day.
22
+
-**Identity Performed Tasks with Unusual Results**: The identity performing an action gets a different result than usual, such as most tasks end in a successful result and are now ending in a failed result or vice versa.
23
+
-**Identity Performed Tasks with Unusual Timing**: The identity does tasks at unusual times as established by their baseline in the observance period. Times are grouped by the following UTC 4-hour windows.
24
+
-**Identity Performed Tasks with Unusual Types**: The identity performs unusual types of tasks as established by their baseline in the observance period. For example, an identity performs read, write, or delete tasks they wouldn't ordinarily perform.
25
+
-**Identity Performed Tasks with Multiple Unusual Patterns**: The identity has several unusual patterns in the tasks performed by the identity as established by their baseline in the observance period.
26
+
27
+
Alert triggers are based on data collected. All alerts, if triggered, are shown every hour under the Alerts subtab.
18
28
19
29
## View statistical anomalies in an identity's behavior
20
30
21
-
1. In the Permissions Management home page, select **Activity triggers** (the bell icon).
31
+
1. In the Permissions Management home page, select **Alerts** (the bell icon).
22
32
1. Select **Statistical Anomaly**, and then select the **Alerts** subtab.
23
33
24
34
The **Alerts** subtab displays the following information:
@@ -39,9 +49,9 @@ Statistical anomalies can detect outliers in an identity's behavior if recent ac
39
49
-**View Trigger**: Displays the current trigger settings and applicable authorization system details
40
50
-**View Trigger**: Displays the current trigger settings and applicable authorization system details
41
51
42
-
## Create a statistical anomaly trigger
52
+
## Create a statistical anomaly alert trigger
43
53
44
-
1. In the Permissions Management home page, select **Activity triggers** (the bell icon).
54
+
1. In the Permissions Management home page, select **Alerts** (the bell icon).
45
55
1. Select **Statistical Anomaly**, select the **Alerts** subtab, and then select **Create Alert Trigger**.
46
56
1. Enter a name for the alert in the **Alert Name** box.
47
57
1. Select the **Authorization System**, Amazon Web Services (**AWS**), Microsoft **Azure**, or Google Cloud Platform (**GCP**).
@@ -72,9 +82,9 @@ Statistical anomalies can detect outliers in an identity's behavior if recent ac
72
82
73
83
1. Select **Save**.
74
84
75
-
## View statistical anomaly triggers
85
+
## View statistical anomaly alert triggers
76
86
77
-
1. In the Permissions Management home page, select **Activity triggers** (the bell icon).
87
+
1. In the Permissions Management home page, select **Alerts** (the bell icon).
78
88
1. Select **Statistical Anomaly**, and then select the **Alert Triggers** subtab.
79
89
80
90
The **Alert Triggers** subtab displays the following information:
@@ -115,7 +125,7 @@ Statistical anomalies can detect outliers in an identity's behavior if recent ac
115
125
116
126
## Next steps
117
127
118
-
- For an overview on activity triggers, see [View information about activity triggers](ui-triggers.md).
128
+
- For an overview on alerts and alert triggers, see [View information about alerts and alert triggers](ui-triggers.md).
119
129
- For information on activity alerts and alert triggers, see [Create and view activity alerts and alert triggers](how-to-create-alert-trigger.md).
120
-
- For information on rule-based anomalies and anomaly triggers, see [Create and view rule-based anomalies and anomaly triggers](product-rule-based-anomalies.md).
121
-
- For information on permission analytics triggers, see [Create and view permission analytics triggers](product-permission-analytics.md).
130
+
- For information on rule-based anomaly alerts and alert triggers, see [Create and view rule-based anomaly alerts and alert triggers](product-rule-based-anomalies.md).
131
+
- For information on permission analytics alerts and alert triggers, see [Create and view permission analytics alerts and alert triggers](product-permission-analytics.md).
0 commit comments