Process Usage

The Process Usage model tracks a user's process usage activity in time and creates a model for the predicted weekly behavior patterns.

Enable the Process Usage model to track a user's process usage activity in time and create a model for the predicted weekly behavior patterns. If the user's activity deviates from the learned behavior, it is deemed suspicious and a Sense Event is generated to increase the user's risk score. An event to increase the score is also sent when a new process is used by the user.

Event name (new activity)

UBA : User running new process

Event Name (activity deviation)

UBA : Increase in process usage

sensevalue

5

Required configuration

The Process Name property must be defined.

Log source types

Looks at events that have the Process Name property defined for it.