Filtering and Sorting the Display of Risky Users

In the Risky Users section of the User Risk Dashboard, you can filter the display of risky users according to the criteria displayed in the list header, and sort by user risk score or other options.

By filtering the risky user list according to the number of out-of-policy notifications and behavior trends (using the option), you can easily identify users who constantly violate security policies, and those who keep ignoring these violations in spite of being warned or even blocked.

Filtering the Risky Users Display

The Risky Users List header has the following options for filtering the risky users display:

Star

You can use the indicator to mark users according to a priority or for a specific reason.

Use this option to show only the risky users that have been starred.

Use this option to show only the selected risky users.

Enter a user name in the text box and click the Search icon or select a user name from the drop-down list.

Note: The auto-complete feature is active for this option.

Risk Score

Use the score slider to show risky users that have a risk score within a specific range (from 0 to 100).

Use to show only risky users with risky activity for at least one of the selected applications.

From the drop-down list, you can choose to filter by one or more specific applications, or "Select all", then click OK. For example:

To clear the selection and reset the filter, click the X.

Use to show only risky users with at least one of the selected alerts triggered.

From the drop-down list, you can choose to filter by one or more specific alerts, or "Select all", then click OK. For example:

To clear the selection and reset the filter, click the X.

Use to show only new risky users and users whose risk level went up during the last day.

Use to show only risky users with out-of-policy behavior notifications.

Sorting the Risky Users Display

The Risky Users section header has a number of options for sorting the risky users display.

You can sort by the default value User risk score, or click in the text box to open a list of other options by which you can sort the risky users list:

  • Daily score change: to sort by the risk score change from the previous day.

  • Out-of-policy behavior: to sort by users who have out-of-policy behavior notifications.

  • Daily behavior change: to sort by changes in users' behavior on a daily basis.

  • 7-day behavior trend: to sort by user behavior trends on a 7-day basis.

You can click the or icons to display the risky users according to the sorted criteria in ascending or descending order.