In this section:
Viewing Outliers report results
You can view the results of the Outlier Analysis in two formats:
Outliers (table view)
Outliers (table view) is the default view displayed upon generation of an Outlier Analysis report. The table lists all the users (User ID and User Name) and the number of unique documents, unique clients, and unique matters that they've accessed, across the period being analyzed (for example Last Week, Last Month, and so on). Each user’s relevant data is displayed on one row of the table along with User Status. The purpose of the table is to draw your attention to those users who are accessing a greater number of unique clients, matters, and documents than anyone else in the general population.
You can increase the number of rows shown in the Outliers (table view) by using the Rows per page selector.
Scores shown in Outliers (table view)
The Score is a relative indicator of how anomalous the user's behavior is across that activity (that is, unique documents, unique clients, and unique matters). A score of zero is used to indicate typical behavior across the users being analyzed. If a user is assigned a Score that is greater than zero, this indicates that the user's behavior across the activity is greater than the average. If the user's Score is lower than zero, this indicates that the user's behavior across the activity is less than that of the average of the users within the group.
The greater the Score, the more anomalous the user's behavior is. There's no theoretical upper or lower limit on the Score.
Searching for a user in Outliers (table view)
You can search for a specific user in the Compliance report by using the Filter User search bar.
Adjusting column visibility in Outliers (table view)
You can adjust the visibility of columns in the Outliers list as required.
Select the Settings icon to adjust which columns are visible. Note that the Name and Client Count (Score) columns are always shown and can't be hidden.
Additional information in Outliers (table view)
Global Exclusions List
You can add or remove users from the Global Exclusions List.
Add: Select the check boxes next to the users and then select Add to Global Exclusions List to add them.
Remove: If the user is already part of the Global Exclusions List, then select Remove from Global Exclusions List to remove them.
NOTE:
Multiple users of the same global exclusion status can be selected and (simultaneously) added or removed as required.
User Status
If a user is globally excluded, then the User Status column indicates this with the text "Globally Excluded", and a red circle adjoining the text.
sidebar
From the table, select on a row to select a user. A filled check box displays beside the user name. If only one user has been selected, View Charts appears next to Add to Global Exclusions List. Select the View Charts button to view the user's activity details in the sidebar. Refer to Analyzing user activity with the sidebar for further details on how to use, and the information contained within, the sidebar. Use the Expand icon in the top-right corner of the panel to view the Activity Details in a separate pop-up window. This can make viewing the charts easier.
NOTE: If no users are selected, or more than one user is selected, in Outliers (table view), the View Charts button won't be displayed.
TIP: You can generate a CSV or PDF report of all the users, with the client, matter, and document counts, along with the status of the relevant users, listed in the file. Refer to Exporting User Data from Outlier Reports.
3D Chart view
The 3D Chart view represents the activity level of users in the selected time range. The main purpose of this chart is to help in the identification of outliers. Users with a typical usage pattern are grouped together in a cluster, while outliers are those users whose activity level lies at a notable distance from the activity levels of other users. Each data point on the chart represents a user, and the x, y, and z axes represent the number of clients, matters, or documents they have accessed. You can hover your pointer over each data point to view the user’s name, and the count of unique clients, matters, and documents accessed by that employee for the period calculated. You can also see the Client, Matter, and Document Scores for each user.
NOTE: When Outlier Analysis is run for the first time in Threat Manager, it's highly recommended that you use the Outliers (table view) to identify outliers to populate the Global Exclusions List. This is because the 3D Chart can take a long time to render when it's first run. This is because in certain situations, the 3D Chart can take a long time to render when first analyzing the activity of outlier accounts, including walls or other robot accounts, that generate a huge volume of activity. You can use the full functionality of the 3D Chart view on all additional runs.
Open the 3D Chart view, select the 3D Chart tab, which is located beside the Outliers tab.
TIP: Drag anywhere on the 3D chart to rotate the chart in 3D.
Scores shown in 3D Chart view
In 3D Chart view, the x, y, and z axes plot the Scores for each activity. The Score is a relative indicator of how anomalous the user's behavior is across that activity (that is, unique documents, unique clients, and unique matters). A score of zero is used to indicate typical behavior across the users being analyzed. If a user is assigned a Score that is greater than zero, this indicates that the user's behavior across the activity is greater than the average. If the user's Score is lower than zero, this indicates that the user's behavior across the activity is less than that of the average of the users within the group.
The greater the Score, the more anomalous the user's behavior is. There's no theoretical upper or lower limit on the Score.
Additional information in 3D Chart view
User Status
The 3D cluster chart uses the following color format for bubbles in the chart to denote if the users are globally excluded or not:
Blue: Not-Globally-excluded user(s)
Red: Globally excluded user
Tool tip
A tool tip displays upon mouse hover for each data point or bubble in the chart. This provides the User's ID, User's Name, Client Count and Score, Matter Count and Score, and Document Count and Score.
Positive and negative scores in the tool tip
A positive score indicates that the user’s count is above the group average count for that activity, while a negative score indicates that the user’s count is below the group average count for that activity. This is explained further in the illustrative example below.
Illustrative example:
The average counts for the activities are as follows: Clients (8), Matters (16) and Documents (100).
Negative Score: For user A, the Documents score is -0.65 and this score corresponds with a document count of 70. Because the score is negative, you can conclude that the count of 70 is below the group average count for the Document activity (100). This means that the count of 70 is low relative to the rest of the users in the firm.
Positive Score: For the same user A, the Clients score is +1.95 and this score corresponds with a client count of 15. Because the score is positive, you can conclude that the count of 15 is above the group average count for the Client activity (8). This means that the count of 15 is high relative to the rest of the users in the firm.
Sidebar: When a user is selected in the 3D chart, a collapsible panel or sidebar appears on the right with the Client, Matter, Document, and Activities histograms or charts that provide granular details. Refer to Analyzing user activity with the sidebar for further details on how to use, and the information contained within, the sidebar. Use the 
button in the top-right corner of the panel to view the Activity Details in a separate pop-up window; this can make for easier viewing of the charts.
TIP: You can download CSV or PDF reports for specific users from the 3D Chart View. Refer to Exporting user data from Outlier reports below.
Analyzing user activity with the sidebar
The sidebar available in the Outliers (table view) and 3D View and described in the preceding sections displays activity charts which let you get an overview of user activity over time, and to examine the activities of that user more closely for a given time in the specified date range.
Details of the activity charts shown in the sidebar are given below.
Activity charts
There are up to four additional charts that display when the sidebar (described in the preceding sections) is opened. These are referenced in the sections below.
Charts will display only when there's relevant data available. For example, if a selected user hasn't accessed any documents within the given time range, the Documents chart won't display. If there is no relevant data, a message will display in place of that chart, stating that "There is no data to show [that type of activity]".
You can close the sidebar showing the Activity charts by clicking the X at the top left of the sidebar, at any time.
Using the Activity charts
Clients chart
This displays the number of Clients accessed by the user during the specified date range. Depending on the date range chosen, the bar(s) shown will represent the total count for years, months, weeks, days, or hours. Hovering the pointer over any bar displayed in the chart displays the exact count of relevant activities for that bar. To drill down into the results—for example, to drill down from year view to month view—select any bar in the chart. To drill up to the previous level, select Back in the upper right-hand side of the chart. For a time/date range of years, months, weeks, or days, the number of Clients are charted on the vertical (y) axis, and the relevant date range on the horizontal (x) axis. When you drill down to the maximum extent and select a bar that represents a single hour, the vertical (y) axis shows the Activity Count (the number of times that a particular Client was accessed by that user in that hour) and the horizontal (x) axis show the name(s) or number(s) of the Client(s) accessed during that hour.
Matters chart
This displays the number of Matters accessed by the user during the specified date range. Depending on the date range chosen, the bar(s) shown will represent the total count for years, months, weeks, days, or hours. Hovering the pointer over any bar displayed in the chart displays the exact count of relevant activities for that bar. To drill down into the results—for example, to drill down from year view to month view—select any bar in the chart. To drill up to the previous level, select Back in the upper right-hand side of the chart. For a time/date range of years, months, weeks, or days, the number of Matters are charted on the vertical (y) axis, and the relevant date range on the horizontal (x) axis. When you drill down to the maximum extent and select a bar that represents a single hour, the vertical (y) axis shows the Activity Count (the number of times that a particular Matter was accessed by that user in that hour) and the horizontal (x) axis show the name(s) or number(s) of the Matters accessed during that hour.
Documents chart
This displays the number of Documents accessed by the user during the specified date range. Depending on the date range chosen, the bar(s) shown will represent the total count for years, months, weeks, days, or hours. Hovering the pointer over any bar displayed in the chart displays the exact count of relevant activities for that bar. To drill down into the results—for example, to drill down from year view to month view—select any bar in the chart. To drill up to the previous level, select Back in the upper right-hand side of the chart. For a time/date range of years, months, weeks, or days, the number of Matters are charted on the vertical (y) axis, and the relevant date range on the horizontal (x) axis. When you drill down to the maximum extent and select a bar that represents a single hour, the vertical (y) axis shows the Activity Count (the number of times that a particular Document was accessed by that user in that hour) and the horizontal (x) axis show the name(s) or number(s) of the Documents(s) accessed during that hour.
Activities chart
This displays all of the activities performed by the selected user across the entire date range. Activities are color-coded, with a key above the chart. The number of Activities is charted on the vertical (y) axis, and the date range is charted on the horizontal (x) axis. Hovering the pointer over any bar displayed in the chart displays the exact count of relevant activities, and the date of that bar.
TIP: You can export chart data to a CSV or PDF file. Refer to Exporting User Data from Outlier Reports below.
Using the sidebar to add users to Global Exclusions List
You can add the selected user (in the table, or in the 3D chart) to the Global Exclusions List by clicking the Add to Global Exclusions List slider. Note that if you wish to exclude multiple users, you can do so as described in the Outliers (table view) section above.
Exporting user data from Outlier reports
Exporting user data for a single user
You can export user data to a CSV or PDF file and save it on your local file system. The documents (in the Documents CSV or PDF), matters (in the Matters CSV or PDF), and clients (in the Clients CSV or PDF) accessed by a user on a given day within the specified time range, user's activities on those documents, matter and client names, type of documents, client ID, matter ID, and several other details are available in the exported file.
In the Outliers (table view) page:
Select a user by clicking on the row of that user.
Select View Charts. The Documents, Clients, Matters, and Activities chart for the selected user are displayed in the right pane of the page.
Select the Download icon below the Clients, Matters, or Documents chart, as required.
Select:
Download as CSV
orDownload as PDF
The CSV or PDF file is saved to your local file system in a standard file name format. For example, User A documents activity for 02-19-2025 to 08-18-2025 (username documents activity time-range), User B matters activity for 02-19-2025 to 08-18-2025 (username matters activity time-range), and User C clients activity for 02-19-2025 to 08-18-2025 (username clients activity time-range).
OR
In the 3D Chart page:
Select a data point in the 3D cluster chart to select a user. The Documents, Clients, Matters, and Activities chart for the selected user are displayed in the right pane of the page.
Select the Download icon below the Clients, Matters, or Documents chart, as required.
Select one of the following:
Download as CSV
Download as PDF
The CSV or PDF file is saved to your local file system in a standard file name format. For example, User A documents activity for 02-19-2025 to 08-18-2025 (username documents activity time-range), User B matters activity for 02-19-2025 to 08-18-2025 (username matters activity time-range), and User C clients activity for 02-19-2025 to 08-18-2025 (username clients activity time-range).
Exporting user data for all users in scope
You can generate a CSV or PDF report of all the users. In the Outliers (table view) page:
Select the Download icon at the top-right of the user list.
Select one of the following:
Download as CSV
Download as PDF
The CSV or PDF file with the client, matter and document counts, along with the status of the relevant users, are listed in the file, which is saved to your local file system with a standard file name format.