This section describes the iManage Threat Manager components and how they interact. Understanding the system architecture helps you configure and manage Threat Manager effectively.

The architecture follows a data flow model: Data is collected from iManage Work Server, transformed into a standardized format, then ingested and analyzed in the Analytics Server, and presented through the Threat Manager user interface.

  1. Data Sources: Data is collected from iManage Work Server.

  2. Data Transform Process: Data is converted into a standardized format.

  3. Analytics Server: Processes and analyzes the transformed data.

  4. Analytics Database: Stores the processed data.

  5. Analytics Engine: Analyzes data using machine learning and statistical algorithms.

  6. REST Interface: Exposes Analytics Server functionality to the application.

  7. User Interaction: Delivers insights through dashboards, reports, and alerts.

  8. Mail Server: Sends notifications to users and external applications.

In this section:

Components

iManage Threat Manager consists of:

  • Data Sources: SQL Database for iManage Work Server. iManage Threat Manager ingests data from Audit Logs, User Information, and Client & Matter tables.

  • Analytics Server: Processes data and performs analysis through the Analytics Database, Analytics Engine, and REST Interface.

  • User Interaction: iManage Threat Manager application that presents insights and receives user requests.

Data sources

NOTE: Numbers in parentheses in this section—for example, (1), (2)—correspond to the number items in the architecture diagram shown above.

Data (1) is collected from internal sources such as the iManage Work SQL database. The data sources are then processed through data transformation (2), which converts incoming data into a single standardized format.

Ingestion and analysis

The Analytics Server (3) consists of the Analytics Database (4), Analytics Engine (5), and REST Interface (6).

  • The Analytics Database stores the processed data, which is used for analysis.

  • The Analytics Engine performs statistical analytics using machine learning and statistical algorithms.

  • The REST Interface services the iManage Threat Manager application requests.

After transformation, the data is stored in the Analytics Database for analysis by the Analytics Engine, keeping the production SQL database unaffected. The Analytics Engine identifies real-time threat indicators and anomalous behavior. The Analytics Server functionality is exposed through the REST API.

User interaction

User actions in iManage Threat Manager—such as creating monitoring rules and performing outlier analyses—are serviced by the Analytics Server. The interface (7) delivers actionable insights through dashboards, information views, reports, and alerts. The Mail Server (8) supports notification delivery to users and external applications.

For more information about the features provided by iManage Threat Manager, refer to iManage Threat Manager User Help.