Accessing the User Risk Dashboard

From the ITM On-Prem (ObserveIT) Insider Threat intelligence platform, there are two ways to explore a user's activity profile:

• Via the User Risk Dashboard tab (when viewing risky users or risky applications)

• By selecting the user directly from the User Activity Profile tab.

In order to view the profile of a user on whom an alert was not yet generated, you must use the second option (i.e., select the User Activity Profile tab). By using the User Risk Dashboard tab, you can see alerts that were already generated for users, which will help you to choose which user activity profiles to investigate.

These tabs are available when you click Insider Threat Intelligence in the ITM On-Prem (ObserveIT) Management Console.

To access a user's activity profile from the User Risk Dashboard

1. Click the User Risk Dashboard tab.

2. In the Risky Users section of the User Risk Dashboard:
   • Click Investigate beneath the user whose activities you want to investigate, and select Explore activity profile.

   -Or-

   • Click a Risky Application that you want to investigate for a user, and select Explore application usage.

   For example:

   

   The User Activity Profile tab opens, displaying aggregated information about the user's activities. For details, see Viewing a User's Activity Profile.

To access a user's activity profile from the User Activity Profile tab

1. Click the User Activity Profile tab.

2. Click Choose User to display a list of user names, from which you can select the user whose activity profile you want to investigate. Note that you can also use the search option to filter the list.

   The list displays the number of users for which session information was collected during the profile period (by default, the last 90 days).

   For example:

   

   The User Activity Profile page is refreshed to show aggregated information about the selected user's activities. For details, see Viewing a User's Activity Profile.