Outliers

When the feature flags are enabled, Guardium Insights uses Outliers to automatically identify abnormal server and user behavior, providing early detection of possible attacks.

The Outliers feature looks for anomalies on the database and database user level. It studies normal behavior of a database over a certain period and builds a statistical model based on these observations. It then flags outliers of this model to identify potential risks, such as a certain user who normally works a regular 9-5 workday but one day logs in during the weekend.

An outlier is defined as a statistically abnormal behavior that is donethat is by either a database or a particular user on a database. And that occurs in a particular time period that is outside of the “normal” time frame. Or, something done outside the scope of the particular database or user's usual activity. Outliers can indicate a security violation that is taking place, even if the activities themselves do not directly violate an existing security policy.

For example, if the Outliers engine alerts you to a high volume of failed log-ins or exceptions, these alerts can indicate brute force attacks or SQL injections. Perhaps from a disgruntled employee or hacked user account that is making bad changes or extracting much data.

In other words, the Outliers feature can be a valuable tool in identifying danger in actions that are not inherently dangerous independently, that standard safeguards might overlook.

User activity that is identified as a suspected outlier includes:

• When a user accesses a table for the first time.
• When a user selects specific data in a table that they never selected before.
• Exceptional volume of errors. For example, an application generates more SQL errors than it has in the past. This volume might indicate that an SQL injection attack is in progress.
• Activity that itself is unexceptional, but its volume is unusual.
• Activity that itself is unexceptional, but the time of activity is unusual. For example, a DBA is accessing a particular table more frequently than in the past. This frequency might indicate that the DBA is slowly downloading small amounts of data over time.

Database activity that is identified as a suspected outlier includes:

• Exceptional volume of errors
• Activity that itself is unexceptional, but its volume is unusual.
• Activity that itself is unexceptional, but the time of activity is unusual.

Each hour, if the Outliers engine indeed found outliers, the Outliers feature displays a new report in the summary reports page with a list of which Outliers types were found. Each row that lists an Outliers type in the summary report might be tied to many rows of Outliers details. These details are displayed separately in the details report.

The outliers that are identified by the Outliers engine and displayed in the reports page as output also serves as input for the Risk Events feature. In Risk Events, you can decide whether to merely view the input in a drill-down in the Reports page, or take further action in the Risk Events UI.

The table displays some examples of use cases that might display in the reports or Risk Events, each anchored to one of the Outliers types. Refer to the use case table to understand the kinds of risks the Outliers that are listed in your summary and details reports might indicate.

Outliers data comes from either Guardium® Data Protection, Guardium Insights, or both. You can read about your options for data streams in the Feature flag topic.