Review User Profiles and Process Anomalies

The user profile enables you to investigate user behavior and take a closer look at anomalies.

To view a user profile

  • On the Behavior Anomalies assessment dashboard, locate a user and click View Profile next to his or her name.

The user profile page contains the following sections:

  • User data with the name and the total risk score. Click Show user activity below the total risk score, to launch the Interactive Search in a new window. Use it to see all user actions, including those that were not treated as anomalies.
  • The Risk score timeline that demonstrates anomalous activity surges. Modify the timeframe to narrow down the results.
  • The Risk score by top five alerts chart that outlines the most frequent anomalies provoked by user. To see the chart, click the pie chart icon in the upper left corner of the page.
  • The anomalies list displays details for each anomaly: the alert that was triggered, the date and time, the risk score and anomaly status.

    Double-click an entry to see more details: who did what, when and where the action was made, etc. Navigate to Linked actions and click Show user activity or Show this activity record to invoke Interactive Search and see all user actions or a specific action correspondingly.

NOTE: Netwrix Auditor shows only the top 2,000 anomalies. Modify the timeframe or hide reviewed anomalies, and then click Refresh to see more anomalies.