The Behavior Analytics > Analyze function in Behavior Analytics provides the ability to view a summary analysis of a specified time range and to also perform a more detailed ad hoc (on-demand) analysis to detect at-risk behavior.

The Behavior Analytics > Statistics function provides a way of viewing group means, standard deviations, and thresholds for each activity over a specified date range.

Analyze

To access Analyze in iManage Threat Manager, select Behavior Analytics > Analyze from the iManage Threat Manager Home Screen or navigation bar.

Analyze lets you select a period in the past for which to perform on-demand analysis on historical data, looking for anomalous, potentially malicious behavior during that period. When using Analyze, you must first select the period for which iManage Threat Manager computes the thresholds that'll help in assessing whether a behavior is potentially malicious or not. These thresholds are computed by looking at hundreds and thousands of user transactions during the specified period and are computed for each activity. Any user who exceeds the thresholds for any activity generates an alert. Using these threshold values as the baseline, you can then run an analysis across any custom period looking for alerts or activity for a user.

If you want to see all activity of a user, enable Ignore Group Thresholds when establishing thresholds.

Establishing thresholds and setting scope

1. Select a period in the past from the Date Range drop-down menu for threshold calculation. You can select Last Week, Last Month, Last 3 Months, Last 6 Months, Last Year or provide a custom date range.

   • If you've entered a custom date range, select Apply.

2. Select Time Zone of Users. The default system time zone configured by your Configuration Manager is displayed here. However, you can choose to change the time zone for threshold calculations. Select Time Zone of Users. The drop-down list displays the time zones and you can select the time zone of your region from the list. For example, America/New_York. 

3. Specify the Users & Groups who you want to perform the analysis on. By default, Everyone is included, and the Global Exclusions List is excluded.
   
   You can specify users and groups to include and/or users and groups to exclude, from the scope of the analysis.

   1. If you want to adjust the users or groups included in the scope of the analysis, select Edit in the Include panel. The People to Include dialog appears and a list of available users and groups is displayed. 

      1. Use the filters as required and select the check boxes for the users and groups, to include those users or groups in the scope.

      2. After you've included all the users and groups required, select OK. A list of the included users and groups is displayed on the Include panel.

   2. If you want to adjust the users or groups excluded from the scope of the analysis, select Edit in the Exclude panel. The People to Exclude dialog appears and a list of available users and groups is displayed.
      
      The Global Exclusions List is excluded by default. The Global Exclusions List comprises those users or accounts with a legitimate reason to behave differently from the general population of users in your firm and who shouldn't therefore be included in analysis. The Global Exclusions List is typically reserved for accounts that enforce ethical walls, import documents, perform agent functions, otherwise administrate the system, and so on.

      1. Use the filters as required and select the check boxes for the users and groups, to exclude those users or groups from the scope of the analysis.

      2. After you've excluded all the users and groups required, select OK. A list of the excluded users and groups is displayed on the Exclude panel.

4. If required, you can Ignore Group Thresholds by moving the slider. Group thresholds can be ignored if there's a need to ignore the impact that peer-group behavior has on the analysis. When group thresholds are ignored, alerts are prioritized based on deviations from a user's normal behavior only. By default, group thresholds aren't ignored.

5. Select Next. A collapsible panel Thresholds appears on the right, where the threshold values generated for default activities are displayed. By default, the following activity types are selected: Client, Document, Matter, Close, Delete, Open, View, Mail, Print, Checkout, and Export.

   
   From this panel you can optionally adjust the date range and scope settings you have already entered.

6. Select Add/Remove Activities to specify the activities that you're interested in for generating threshold values. The Add/Remove Activities dialog appears.

   1. Select the check boxes to select the required activities. Alternatively, you can select a predefined activity set. All the activities that are part of that activity set get selected by default. For more information on activity sets and how to create activity sets, refer to the Configuration sections in iManage Threat Manager Administration Help. 

   2. Select the Reset Thresholds check box. This recalculates all the threshold values for the unique clients, unique matters, and unique documents based on the selected activities for the defined period.

   3. Select Update. The updated list of activities is listed in the Activity Thresholds column.

   The Activity Thresholds column displays the following information:

   • Activity

   • Minimum and maximum activity count

   • Mean value for an activity

   • Recommended group / peer group threshold value for each activity in the list

   The activity thresholds can be expressed in terms of Count or Standard Deviation. You can select and view the values in the preferred format. 

7. If required, thresholds can be modified, or restored to default values.

   Setting a custom dynamic threshold

   1. On the row of the relevant activity, Select the Three Dots icon.

   2. Select Edit Group Threshold.

   3. Select the Dynamic option.

   4. Enter a number (with decimal places, if required) or use Increase and Decrease to increase or decrease the number of standard deviations that'll be used to calculate the threshold values. The values increment +/- 0.1.

   5. Select Save.

   When the group threshold is set to a number of standard deviations (the default value is 4) then the group threshold is recomputed whenever the rule is run.

   Setting a custom fixed ("pinned") threshold

   1. On the row of the relevant activity, select the three dots icon.

   2. Select Edit Group Threshold.

   3. Select the Pinned option.

   4. Enter a number (with decimal places, if required) or use Increase and Decrease to increase or decrease the threshold values. The values increment +/- 1.

   5. Select Save.

   Resetting a custom threshold value to default value

   You can reset a custom threshold value to a default value, as follows:

   1. On the row of the relevant activity, select the Three Dots icon.

   2. Select Restore Default.

   You can use these threshold values as the baseline and run the simulation for any custom time period.

Perform analysis

To perform analysis:

1. Select a period in the past from the Date Range drop-down menu for analysis. You can select Last Week, Last Month, Last 3 Months, Last 6 Months, Last Year or provide a custom date range.

   • If you've entered Custom date range, select Apply.

2. Select the type of analysis to perform, from the following options:

   1. Deep Analysis

      • Recalculates the threshold for each day being analyzed when the threshold period is dynamic. The analysis will take longer to run but will generate more accurate risk scores..

   2. Quick Analysis

      • Uses pre-calculated thresholds for each day being analyzed. The analysis will run faster but could result in lower accuracy for the risk scores.

   Both types of analysis give the same output format, as described in Viewing analysis results, and User activity counts are the same for Quick and Deep analyses.

3. Analysis results are displayed as they are generated and an analysis progress bar is displayed along with a live display of the date range that the analysis has till then completed.

   When analysis is complete, “Analysis complete” displays above the progress bar and a green check mark is displayed.

4. If required, you can stop a running analysis with the Stop Analysis button.

5. The outcome of the analysis is provided in the Detail View, Summary Chart, and Bubble Chart. Refer to Viewing analysis results.

Viewing analysis results 

The results of the analysis are displayed across the following tabs described below.

Detail View (tab)

The Detail View shows, on a per-user basis, the alerts that a user generated on a given day. Each row shows the risk score as well as the activity counts that are attributed to the user.

When an activity count (number) is displayed with a gray background, this indicates that the user has exhibited a behavior different from the peer group.

When an activity count (number) is displayed enclosed in a rectangle with a background color that corresponds to the appropriate threat level, this indicates that the user has behaved differently from the peer group and also from how that user typically behaved in the past.

When an activity count (number) is displayed with a colored background, this indicates that the user has behaved differently from the peer group and also from how that user typically behaved in the past. The color of the background is defined by the threat level associated with that risk score (from lowest—yellow, to highest—red).

Sorting and filtering the information

You can sort the list by selecting the column heading (unless indicated otherwise below), by the following:

• Date, using the date picker

• Risk Score

• Name

• Activity

  • Each activity is listed in a separate column.

The following filter is also available:

• Users (text filter)

Using the tooltips provided for at-a-glance information

When you place the cursor over any activity count number, details of the risk score as well as the individual and peer-group behavior are displayed in a tooltip. These give an investigator easy visibility into the extent to which an individual has behaved differently from personal and peer-group norms:

• On a peer-group basis, the mean activity of the peer group daily is displayed, as well as the group threshold. The group threshold is the point at which any user in the group is exhibiting a behavior different from the behavior typically exhibited by the group.

• On an individual basis, an individual mean, which is the activity that the user typically performs daily, is displayed, along with the individual standard deviation and the individual threshold. The individual threshold is the inflection point at which the user is exhibiting a behavior statistically different from the user's norm.

Also, colored activity count rectangles show a fill, upon mouse-over of the rectangle or of its containing row, to indicate the extent to which that activity has contributed to the overall risk score. The greater the percentage of the rectangle filled, the greater the contribution of that activity towards the risk score. If any activity contributes one-hundred percent to the overall risk score, its rectangle will display as a solid color upon mouse-over.

Detail View: Viewing and downloading Activity Charts

Select a row (user) in the table for more details. The Clients, Matters, and Documents Activity Charts, and All Activities Chart for the selected user are displayed. You also have the option to export the relevant Documents, Clients, and Matters details into a CSV, EXCEL, or PDF file. Refer to Viewing and downloading Activity Charts for more information.

Summary Chart

The Summary Chart is a bar graph that represents the number of prioritized alerts, by date. Alert data is displayed for Threat levels—Elevated and above by default.

You have the option to view or hide results on the chart by selecting or de-selecting threat level keys on the chart legend:

Selecting a key causes it to be struck through: any results with a threat level which is struck through (for example: Low) on the legend won't be shown. Select the key again to remove the strike-through and show the associated results.

Bubble Chart

The Bubble Chart is an interactive chart that displays information in the form of a bubble graph. The size of the bubble is proportional to the number of clients assessed and the height is proportional to the number of matters accessed. The chart gives you a graphical way to visualize the intensity of the alert. 

A larger bubble indicates that information was compromised across several clients, and so the risk may be of greater urgency. 

Select the Labels (Low, Moderate, Elevated, High, or Urgent) below the bubble chart to view or hide the results based on threat levels. Alert data is displayed for Threat levels—Elevated and above by default.

Selecting a key causes it to be struck through: any results with a threat level which is struck through (for example: Low) on the legend won't be shown. Select the key again to remove the strike-through and show the associated results.

You also have the option to export the activity data for a user on the bubble chart into a CSV, EXCEL, or PDF file. Refer to Viewing and downloading Activity Charts for more information.

Viewing and downloading Activity Charts

Accessing Activity Charts

Access activity charts as follows:

• Select a User from the Detail View list.
  OR

• Select a bubble in the Bubble Chart.

Activity Charts are displayed with details. The selected user's User ID and User Name are displayed in the title bar just above the Activity charts. For example, User ID (User Name). If a User Name isn't defined, then only the User ID is displayed. The following charts are available

• Client histogram: This is a bar graph that represents the number of clients accessed by a user on different days within the time period being analyzed. You can drill-down on the Clients histogram to get the Client Name and Activity Count for the Clients that a user accessed on a given day.  

• Matter histogram: This is a bar graph that represents the number of matters accessed by a user on different days within the time period being analyzed. You can drill down on the Matters histogram to get the Matter Name, Client Name, and Activity Count for matters that a user accessed on a given day. To go back one level after drill-down, select Back.

• Documents histogram: This is a bar graph that represents the number of documents accessed by a user on different days within the time period being analyzed. You can drill-down on the Documents histogram to get the Document Name, Client Name, Matter Name, and Activity Count for documents that a user accessed on a given day. To go back one level after drill-down, select Back.

• Activities chart: This chart represents the counts of different activities that a user was performing within the time period being analyzed. Hovering over each point on the chart will display the date, type of activity, and the count. Each activity displayed in the chart can be toggled on and off by clicking the activity listed to the right of the chart. To go back one level after drill-down, select Back.

• Export: You can export data for the selected user to a CSV, EXCEL, or PDF file and save it on your local file system. The Documents, Matters, and Clients accessed by a user on a given day within the specified time range; user's activities on those documents, matters, and clients, type of documents, Client ID, Matter ID, and several other details are available in the exported file. Refer to Export Activity Charts for more information.

Expand or contract the date range displayed in Activity Charts

You have the option to expand (or contract) the date range displayed on the activity charts, to provide a wider (or narrower) chronological context for the alert.

1. At the top right of the activity charts, enter a number into, or use the arrows to adjust the Days before field.
   
   Each of the activity charts is immediately updated with the adjusted date range.
   
   You may extend the date range to a maximum of 999 days before the alert.

2. At the top right of the activity charts, enter a number into, or use the arrows to adjust the Days after field.
   
   Each of the activity charts is immediately updated with the adjusted date range.
   
   You may extend the date range to a maximum of 999 days after the alert.

Export Activity Charts

You can export Clients, Matters, or Documents chart activity information for the selected user into a CSV, EXCEL, or PDF file and save it on your local file system.

The documents, matters, or clients accessed by a user on a given day within the specified time range, the user’s activities on those documents, matters, or clients, the type of documents, Client ID, Matter ID, and other details are available in the exported file.

To export an activity chart data:

1. Below the Clients, Matters, or Documents chart, select the Download button.

2. Select Download as CSV, Download as EXCEL, or Download as PDF.
   The request file is saved to the default download location on your local file system.

Statistics

To access Statistics in iManage Threat Manager, select Behavior Analytics > Statistics from the iManage Threat Manager Home Screen or navigation bar.

Statistics helps you understand the scale and nature of the data analyzed for a particular period and scope, by providing analysis across activities, for example, the average number of exports done per user per day; the maximum number of mails done per user per day, and so on. It provides metrics on Mean, Standard Deviation, Minimum, Maximum, and Threshold values for each activity, for a specific period. You can also use the Global Exclusions List to filter the results in the Summary report.

Adjusting the scope of Statistics

The default scope for statistics is displayed at the top of the page; you can modify this.

Changing the date range

1. Select Date Range.

2. Select Last Week, Last Month, Last 3 Months, Last 6 Months, Last Year or specify a Custom date range.

3. Select OK to confirm your chosen date range or Cancel to ignore any changes to the date range.

4. If you don't need to make any further changes to the report, select Apply. The new date range is applied and the results are displayed immediately.

Specifying people to include or exclude

People to Include

To include users or groups in the Statistics report:

1. Select the Include button in the upper part of the page to open the People to Include dialog.

2. Select the list of users and groups you want to run the report on. The default selection is Everyone.

   1. You can search for users or groups by using the Filter by Name search bar or by using the filter button to filter by users, groups, location, or other properties that may be available.

   2. You can select and deselect a user or group by clicking the specific row or by selecting the check box beside the user or group name.

   3. To deselect all, use the Deselect button beside the counts for selected users/groups and remaining users/groups, or by selecting the icon by the selected users count.

   4. To view active members of a group, select View Members beside the group ID. The group members are shown in a scrollable tool tip.

   5. To view the current selection, select View Selected.

3. Select OK to confirm your users/groups to include, or select Cancel to discard changes.

4. If you don't need to make any further changes to the report, select Apply. The new scope is applied and the results are displayed immediately.

People to Exclude

To exclude users from the Statistics report:

1. Select the Exclude button in the upper part of the page to open the People to Exclude dialog. The Global Exclusions List is selected by default. This implies that activities for those users listed on the Global Exclusions List are excluded from the report.

   • You can disable this option by deselecting Global Exclusions List.

2. Select the users or groups you wish to exclude from the report:

   1. You can search for users or groups by using the Filter by Name search bar or by using the filter button to filter by users, groups, location, or other properties that may be available.

   2. You can select and deselect a user or group by clicking the specific row or by selecting the check box beside the user or group name.

   3. To deselect all, use the Deselect button beside the counts for selected users/groups and remaining users/groups.

   4. To view active members of a group, select View Members beside the group ID. The group members will be shown in a scroll-able tool tip.

   5. To view current selection, select View Selected.

3. Select OK to confirm your users/groups to include, or select Cancel to discard changes.

4. If you don't need to make any further changes to the report, select Apply. The new scope is applied and the results are displayed immediately.

Adjusting column visibility

You can adjust the visibility of columns in the Statistics report list as required.

Select the Settings icon to adjust which columns are visible. Note that the Name column is always shown and can't be hidden.

When columns are hidden/show with this feature, or resized using the column grab handles, you also have an option to Reset the columns to their default visibility and layout.