This page answers frequently asked questions about iManage Threat Manager. Use the table of contents to find answers to common questions about iManage Threat Manager.
In this section:
- Thresholds, Risk Scores and Alerts
- What is a threshold value?
- How are threshold values computed?
- What are Behavior Analytics alerts?
- What are Risk Scores and how are they calculated?
- Risk Score calculation scenarios
- How is the Risk Score calculated when the group threshold is greater than zero and the individual threshold is zero?
- How is the Risk Score calculated when the group threshold is zero and the individual threshold is greater than zero?
- How is the Risk Score calculated when the group threshold is zero and the individual threshold is also zero?
- How are Behavior Analytics alerts prioritized?
- When is a Behavior Analytics alert notification sent?
- Activities
- What activities are tracked for monitoring, reporting, and investigation?
- Metadata (Appname and Comments)
Thresholds, Risk Scores and Alerts
What is a threshold value?
Threshold values mark the transition point between normal behavior and potentially malicious activity. They're computed by looking at hundreds and thousands of individual and group transactions over time. There are two types of threshold value:
Individual thresholds: iManage Threat Manager statistically computes an individual threshold for each activity of a particular user.
Group/Peer Group threshold: iManage Threat Manager statistically computes a group/peer group threshold value for each activity of the group/peer group. This is pertinent because there may be groups that exhibit behavior that is very different from the general population—for example, the Litigation Practice group and/or the Intellectual Property practice group. (A Peer Group consists of all the users in a given scope.)
How are threshold values computed?
The default thresholds for each activity (for example, mail, print, export, and so on) are computed as a multiple of Standard Deviations (SD) away from the mean. This applies to both individual and group threshold values.
What are Behavior Analytics alerts?
A Behavior Analytics alert is a warning that informs you of users displaying potentially suspicious behavior. iManage Threat Manager generates a Behavior Analytics alert when a user’s activity count on a given day exceeds the group/peer group threshold value (of that user’s group) for an activity.
What are Risk Scores and how are they calculated?
Risk Scores are numerical values assigned to users when they exceed both their group threshold and individual threshold for an activity. A user must exceed the group threshold and individual threshold for an activity before a Risk Score is computed for that activity. This numerical Risk Score value is calculated based on the number of standard deviations by which a person has exceeded their individual mean. This ensures that a high-intensity attack gets prioritized based on the extent to which the individual behaves differently from their typical behavior. The greater the variation, the higher the score.
Risk Score is calculated for every activity where the user has exceeded both their group threshold and individual threshold. The user's total Risk Score is a total of their Risk Scores across all activities. Risk scores of up to 999 display numerically; higher values use K, M, and B terminology, and are rounded to the nearest decimal, for example a risk score of 1051 will display as 1.1k.
NOTE: If there's a need to ignore the impact that peer-group behavior has on the generation of alerts for a particular rule, you can configure the rule so that group thresholds are ignored. When group thresholds are ignored, alerts are prioritized based on deviations from a user's normal behavior only. This can help improve accuracy in detecting anomalous behavior in privileged accounts. By default, however, group thresholds aren't ignored.
For more information on the specific types of rules to which iManage recommends that group thresholds are ignored, refer to iManage Threat Manager Best Practices Guide.
Risk Score calculation scenarios
The following scenarios show how the Risk Score is calculated based on different combinations of the group and individual thresholds.
How is the Risk Score calculated when the group threshold is greater than zero and the individual threshold is zero?
In this situation, we raise an alert when the user's activity exceeds the group threshold. As the individual has never exhibited this behavior before, but their peer group has, we score the alert (for any such activity) based on the deviation of the user's activity from the peer group baseline behavior.
How is the Risk Score calculated when the group threshold is zero and the individual threshold is greater than zero?
A group threshold of zero means that the user's peer group hasn't performed such activity before, based on historical analysis. In such a situation, if the user's activity exceeds the group threshold (zero), an alert is raised and a score is generated based on the deviation from the user's normal.
How is the Risk Score calculated when the group threshold is zero and the individual threshold is also zero?
A group threshold of zero and an individual threshold of zero means that neither the user nor the user's peer group has performed such activity before, based on historical analysis. Clearly, such an event is an anomaly and therefore an Urgent alert is raised.
NOTE: For more information on how Risk Scores are calculated, contact iManage support.
How are Behavior Analytics alerts prioritized?
The higher the total risk score across activities, the higher the priority, and in turn, the higher the user will be listed in the Behavior Analytics alert reports.
When is a Behavior Analytics alert notification sent?
When creating a Behavior Analytics alert rule, you can set a minimum security level for notifications. A notification is sent only when a new alert meets or exceeds this level. Behavior Analytics notifications include an Open Alert link that opens the corresponding alert in Alert Details for investigation.
Example:
A rule is scheduled to run continuously every five hours, starting at 5:00 AM, with alerts triggered for severity Elevated and above.
At 5:00 AM, user A reaches Elevated, generating an alert and sending a notification.
At 10:00 AM, user A remains at Elevated, so no notification is sent.
At 3:00 PM, user A moves to High, generating a new alert and notification.
Later runs that day send no further notifications unless the severity rises again.
NOTE: This example applies only when the rule runs on a continuous schedule.
If Scope Changes are enabled, a notification is sent each time the rule’s scope changes.
Activities
What are activities?
Activities in iManage Threat Manager represent specific user actions performed on documents, emails, folders, or workspaces within the iManage Work system. These actions are tracked through audit logs and are used to detect anomalies, generate alerts, and support compliance reporting.
Threat Manager categorizes activities to help you:
Monitor user behavior
Investigate potential data loss
Identify compliance gaps
Analyze trends across clients, matters, and documents
How are activities used?
Behavior Analytics: Detects deviations from personal and peer-group baseline behaviors.
Compliance Reports: Identifies users not engaging with the document management system.
Matter Activity Reports: Tracks user actions across specific clients and matters.
Outlier Analysis: Flags users with unusually high access to unique documents, clients, or matters.
What are the primary activity categories used in threat detection and behavior analysis?
The three activity types of Client, Matter, and Document are the foundational units used throughout iManage Threat Manager to evaluate user behavior. They're central to:
Defining scope in rules and reports
Calculating risk scores
Identifying outliers
Visualizing user behavior across clients, matters, and documents
Table: Primary activity categories
Activity | Description |
|---|---|
Client | Number of unique clients associated with the documents a user interacted with. |
Matter | Number of unique matters associated with the documents a user interacted with. |
Document | Number of unique documents a user interacted with, based on selected activities. |
What activities are tracked for monitoring, reporting, and investigation?
The following list includes specific actions users may perform within iManage Work. These activities are tracked in audit logs and are used to:
Trigger alerts in Behavior Analytics and Detect and Protect rules
Populate Compliance and Matter Activity reports
Support forensic investigations and usage analysis
Activities are grouped into sets (for example, Threat Monitoring, Compliance Indicating, Activity Monitoring), which determine how unique document, client, and matter counts are calculated. These sets can be configured under Configuration > Settings > Activity Sets.
Table: Activities tracked for monitoring, reporting, and investigation
Activity Name | Description |
|---|---|
Changed Profile | The profile metadata for a document, folder, or workspace was modified. |
Change Security | The security permissions for a document, folder, or workspace were modified. |
Checkin | The document was checked in, updating the official version in the system and making it available to others. |
Checkout | The document was checked out for editing, restricting modifications by others until checked in. |
Close | A document or email was closed without being checked in, indicating changes weren't saved. |
Copy | A document or folder was duplicated within the system. |
Create | A new document, folder, or workspace was created in the system. NOTE: Create is a legacy activity equivalent of Document Create. It is retained for compatibility with rules and reports from earlier Threat Manager versions. |
Create Version | A new version of a document was created, preserving previous versions for reference. |
Declared | A document was declared as a record for compliance or retention purposes. NOTE: Declared and Undeclared may appear separately or as a combined activity (Declared/Undeclared) depending on the report or rule context. |
Document Create | A new document was added to a folder or workspace in the system. |
Document Delete | A document was deleted from a folder or workspace in iManage Work. NOTE: Document Delete replaces the older Delete activity used in previous versions. |
Download to Mobile | A document was downloaded to a mobile device for offline access. |
Email filed | An email was filed into a workspace or folder in the system. |
Exited | A co-authoring session on a document was ended by the user. |
Export | A document, folder, or workspace was exported from the system to an external location. NOTE: This is a legacy activity that combines several export types, including iManage Work Server exports, mobile downloads, Drive synchronizations, and Share uploads. This legacy Export activity is retained for compatibility with existing rules and reports in iManage Threat Manager. For new rules or reports, use the individual export activities to provide clearer insight into export actions: Export from DMS, Download to Mobile, Offline Download, and Export to iManage Share. |
Export from DMS | A document, folder, or workspace was exported directly from iManage Work. It doesn't include:
NOTE: In earlier versions of Threat Manager, the Export activity combined all export types: iManage Work exports, mobile downloads from iMobility for iOS, Drive synchronizations (Offline Download), and uploads to iManage Share. This legacy export activity is retained to ensure compatibility with existing rules and reports. In current versions, the legacy Export activity includes only iManage Work exports, iMobility downloads, and iManage Share uploads. Drive synchronizations are now recorded separately as Offline Download and are no longer counted as part of the legacy Export activity. |
Export to iManage Share | A document, folder, or workspace was exported to iManage Share for external collaboration. |
Folder Delete | A folder and its contents were deleted from a workspace or the system. |
In Draft | A knowledge document was moved to In Draft for further edits. |
Inbox Filer | An email was automatically filed into a workspace or folder when a recipient replied to a sender who has inbox filing enabled in the configuration. |
Interactive Filing | A document or email was manually filed into a workspace or folder by a user. |
Linked Folders | An email was automatically filed into a workspace or folder when it was moved into an Outlook folder that is linked to the corresponding iManage workspace or folder. |
An audit generated when documents are attached to an email. | |
Mailbox Assistant | A document or email was filed into a workspace or folder that was processed by the Mailbox assistant. |
Modify | The content or properties of a document, folder, or workspace were modified. |
Offline Download | A document was downloaded for offline access on a device. |
Open | A document, folder, or workspace was opened for viewing or editing. |
A document was printed from the system. | |
Published | A knowledge document was published and is accessible for reference. |
Purge | A document, folder, or workspace was permanently deleted from the system, making it unrecoverable. NOTE: This activity only applies to cloudimanage.com. In on-premises environments, purge actions are recorded as delete events with the comment “Removed from trash bin.” |
Reconcile | Changes or versions of a document, folder, or workspace were reconciled to ensure consistency. |
Rejected | A submitted knowledge document wasn't accepted as a knowledge document. |
Release | The document was released (unlocked) or closed without changes, making it available for others. |
Remove from Folder | A document or subfolder was removed from a folder or workspace. |
Restore | A deleted document, folder, or workspace was restored to the system. |
Retired | A published knowledge document was marked as retired, indicating it is no longer treated as a reference document. |
Send and File | An email was sent and simultaneously filed into a workspace or folder in the system. |
Submitted | A document was submitted as a knowledge document for review. |
Synchronize | A document, folder, or workspace was synchronized with the system to update changes or ensure consistency. |
Undeclared | The record status of a document was reverted, allowing it to be managed as a regular document. NOTE: Declared and Undeclared may appear separately or as a combined activity (Declared/Undeclared) depending on the report or rule context. |
Unpublished | A published knowledge document was taken offline for further review and editing. |
View | A document, folder, or workspace was viewed by a user in read-only mode. |
Workspace Create | A new workspace was created in the system for organizing documents, emails, and folders. |
Workspace Delete | A workspace and all its contents were deleted from the system. NOTE: Workspace Create and Workspace Delete are tracked as a single activity in some views, but may be split in audit logs or rule criteria depending on configuration. |
Activity set definitions are available in the Activity Sets tab, accessed by selecting Configuration > Settings on the left navigation bar. For more information about activity set definitions, refer to Configuration - Settings section of iManage Threat Manager Administration Guide.
Client, Matter, and Document activity counts are calculated from the unique Client, Matters, and Documents recorded during the period being assessed. For example, if a user created two documents for Client A and 3 documents for Client B, the Client count would be two.
Other (non-client/matter/document) activity counts are determined based on the type of analysis, as outlined below.
Area | Explanation |
|---|---|
Behavior Analytics Alerts | Client: Count of unique clients which had any of the specified activities during the period of analysis. Matter: Count of unique matters which had any of the specified activities during the period of analysis. Document: Count of unique documents which had any of the specified activities during the period of analysis. [Other]: Count of unique documents which had the specified activity performed during the period of analysis. |
Matter Activity Reports | Matter: Count of unique matters which had any of the specified activities during the period of analysis. Document: Count of unique documents which had any of the specified activities during the period of analysis. [Other]: Count of unique documents which had the specified activity performed during the period of analysis. |
Compliance | Activities: A total count of selected compliance activities performed by a user during the analysis period. Clients: The total number of clients upon which the user performed any of the selected activities, during the time frame analyzed. Matters: The total number of matters upon which the user performed any of the selected activities, during the time frame analyzed. Documents: The total number of unique documents upon which the user performed any of the selected activities, during the time frame analyzed. [Other]: Count of unique documents which had the specified activities performed during the period of analysis. |
Outliers | Client: Count of unique clients which had any of the specified activities during the period of analysis. Matter: Count of unique matters which had any of the specified activities during the period of analysis. Document: Count of unique documents which had any of the specified activities during the period of analysis. |
Behavior Analytics > Analyze | Client: Count of unique clients which had any of the specified activities during the period of analysis. Matter: Count of unique matters which had any of the specified activities during the period of analysis. Document: Count of unique documents which had any of the specified activities during the period of analysis. [Other]: Count of unique documents which had the specified activity performed during the period of analysis. |
Behavior Analytics > Statistics | [Other]: Population threshold statistics calculated from the counts of unique documents which had the specified activities performed during the period of analysis. |
Metadata (Appname and Comments)
What are Appname and Comments?
Appname and Comment fields from audit entries in iManage Work are available in relevant CSV downloads.
Appname (Application Name) refers to two distinct audit attributes that appear in reports/exports:
Host application/integration (for example, Word, Outlook, API): identifies the program or integration through which the user performed the action. This value appears in the Compliance > Activity Report export (User Documents Activity sheet) under Application Name. If an activity predates application-name mapping or the value is unmapped, a legacy internal (numeric) ID may be shown.
iManage client type (for example, Work Web, Work Desktop for Windows, iManage Rive, Work for iOS): identifies the iManage client that generated the action. These values come from the DocHistory AppName field in iManage Work and can be localized/mapped through Settings > Language packs in Threat Manager.
For Mail activity, the audit Comments tell you whether the user attached a link to an iManage document, attached the iManage document, or both. These are the audit comments recorded with the action, not the Comment field on the document profile. In other contexts (for example, exports and Share operations), Comments may include other audit-level details captured by iManage Work and surfaced in Threat Manager reports/exports.
The Comment field supports up to 2,000 characters, including hyperlinks. Comments shown in UI lists are clickable and open in an expanded viewer.
Application name can also be used as Detect and Protect rule criteria and as an alert/document filter, drawing on the same underlying application data described above. For details, refer to Creating a Detect and Protect rule and Using the Detect and Protect Alert List.