Behavior Analytics rules use statistical analysis to compute a threat pattern manifested by a threshold value for each activity (for example, downloads, views, mails, and so on). The threat pattern is computed for each user and the peer group they belong to. Each user who engages in anomalous behavior is assigned a risk score. The higher the number of activities in which the user deviated from their personal baseline behavior and peer group baseline behavior, the greater the risk score. Likewise, the higher the deviation from the personal baseline behavior, the greater the risk score will be for that user.

The peer group makes up all the users or groups selected within the scope of the Behavior Analytics Rule. This term is used here to distinguish between Groups of users, as defined in iManage Work.

Behavior will be observed and alerts raised for any users that are part of the scope of the monitoring rule.

Threat Manager also looks back for missed data (for example data that was unavailable due to a library being offline), and when such data becomes available it is incorporated into existing data for the same period, scanned, and analyzed, to update (or create) any Behavior Analytics Alerts (for rules of frequency type Continuous or Scheduled) accordingly. (For information on adjusting the period that Threat Manager looks back for missed data, refer to the (On-premises) Advanced Configuration section in iManage Threat Manager Administration Help.)

Accessing Behavior Analytics > Rules

Access the Behavior Analytics Rules dashboard by navigating to Behavior Analytics > Rules from the Home Screen or the navigation bar. Select Add Rule to add a new rule. The New Behavior Analytics Rule page is displayed.