In this section:

Home screen and navigation bar

After successfully signing in to the iManage Threat Manager application, the Home screen is displayed. The Home screen can be accessed from any page of the application by selecting Home on the navigation bar, which is displayed on the left-hand side of the Threat Manager application.

The Home Screen presents key Threat Manager components. These are also available in the navigation bar. Selecting any of the components on the Home Screen is equivalent to selecting that component on the navigation bar. A list and overview of the components available is provided below.

Overview of key components of iManage Threat Manager

The Home Screen presents the following components:

Detect and Protect

With this component of iManage Threat Manager, you can automate pre-emptive actions when certain predefined, well-known patterns of at-risk behavior have occurred, so that you can limit further data loss. Detect and Protect rules give your organization the ability to automatically neutralize well-known patterns of risk, 24/7.

Powerful metadata- and activity-based criteria allow you to create rules based on information classification, and you can define a lot of automated actions that are taken when rule criteria are met or exceeded. These include warning the user, notifying of compliance, and disabling an account.

• Detect and Protect Rules: Lets you set automated actions to be taken when highly definable criteria are met. For example, you can define a rule that alerts and acts when a single print action or a single mail action is performed on a document in a specified, highly sensitive matter.
  You can also filter rule criteria by the application that performed an activity (for example, Claude, Harvey), which is useful for isolating AI-agent-driven activity from human activity.

• Detect and Protect Alert List dashboard: Presents a consolidated view of alerts generated when Detect and Protect rule criteria are met or exceeded. Any actions taken are also displayed.

Reports generated in Detect and Protect can be exported in CSV, Excel (.XLSX), or PDF format.

For more information, refer to Preventing data loss.

Behavior Analytics

With this component of iManage Threat Manager, you can create and manage rules that identify and generate alerts for suspicious behavior. You can also view all the alerts that are generated when a rule is run and run various analyses.

iManage Threat Manager uses statistical analysis to compute a threat pattern for each activity (for example, downloads, views, and mails) for the group/peer group as well as for individual users. The risk score reflects the number of activities where a user’s behavior deviates from their personal and peer-group baselines. The greater the deviation from personal standard behavior, the higher the risk score will be for that user.

• The Behavior Analytics Alerts List dashboard presents a consolidated view of Behavior Analytics alerts across all Behavior Analytics rules with frequency type "Continuous" or "Scheduled,” on a per-user basis.

• The Behavior Analytics Reports dashboard shows you all of the reports and alerts generated by the Behavior Analytics rules with frequency type "Run Once".

The Analysis components of Behavior Analytics provide the ability to view a summary analysis of a specified time range and to also perform a more detailed on-demand analysis.

• Statistics: Provides a way of viewing group means, standard deviations, and thresholds for each activity over a specified date range.

• Analyze: Allows you to perform an on-demand analysis across any period in the past to detect at-risk behavior.

Reports generated in Behavior Analytics can be exported in CSV, Excel (.XLSX), or PDF format.

For more information on these features, refer to Behavior Analytics.

Matter Activity (Rules and Reports)

With this component of iManage Threat Manager, you can create and manage rules that track user activity (for example—views, downloads, and checkouts) on a client and/or matter basis. The user activity across the selected clients and matters is aggregated on a per-user basis across the period being analyzed.

The Matter Activity Reports dashboard shows you all of the reports generated by the Client/Matter Activity Rules. These reports can be filtered by pre-defined periods (Today, Last Week, Last Month, Last 3 Months, Last 6 Months, Last Year, or for a Custom period).

Additional information is provided in the report.

Reports generated in Matter Activity can be exported in CSV, Excel (.XLSX), or PDF format.

For more information, refer to Matter Activity (Rules and Reports).

Compliance

The compliance adoption and trending functionality helps your organization identify enabled users not filing content or interacting with iManage Work, and understand the patterns and trends of such compliance in detail.

Compliance-adoption reports give you details at a total level on document management activities performed by the users specified for analysis, giving you visibility into documents created, emails filed, and other compliance-indicating activities.

The Compliance-trending dashboard charts allow you to trend active users, individual activities, and overall engagement with iManage Work.

The Compliance-activity report feature allows you to filter one or more users, a time frame, and activities of interest, then download a report. Reports generated in Compliance can be exported in CSV, Excel (.XLSX), or PDF format.

For more information, refer to Compliance.

Outliers

This component of iManage Threat Manager can help in the detection of advanced threats carried out systematically over a long period over low activity thresholds. Outlier analysis helps identify users whose usage patterns are significantly different from the general population of users.

For more information, refer to Outliers.

Configuration

The configuration section includes:

• Threat Manager Settings for system configuration.

• Roles for role editing and assignment.

• Exclusions which lets you add users to the Global Exclusions List.

The items visible in the Configuration section are dependent on the role that you've been assigned by your system administrator.

For more information on Exclusions, refer to Exclusions.

(For information on other settings available in the Configuration tab, refer to the Configuration sections in iManage Threat Manager Administration Help.)

Responsive design

iManage Threat Manager uses a responsive design, so the layout of some items may differ from what’s shown in this document when viewed on narrow screens such as mobile devices. However, all administrative functionality remains available on such devices.

You can hide, show, and resize columns manually throughout the iManage Threat Manager interface, using the column resize handles, and the column visibility options described in the relevant parts of this guide.

Resizing columns

Column width can be adjusted dynamically by dragging the handles on column headers, or by double-clicking them to expand.

Columns can be customized on all list pages in Threat Manager, and your choices are remembered on next sign-in. 

Figure: column resize handles (one highlighted)

Viewing the version number of iManage Threat Manager software components

You can view the version number of iManage Threat Manager software components whenever required, as follows:

1. On any page of the iManage Threat Manager application, select <username> where <username> is the name of the user currently logged in. This is displayed in the upper right corner of the application.

2. From the drop-down menu, select About.
   The software versions of the following components are displayed:

   • analytics-taskservice

   • analytics-dataimporter-api

   • analytics-dataimporter

   • analytics-data

   • analytics-engine

   • analytics-ui

   • analytics-activemq

3. To exit the About screen, select the Close icon.

Signing out of the iManage Threat Manager application

To sign out of iManage Threat Manager:

1. On any page of the iManage Threat Manager application, select <username> where <username> is the name of the user currently logged in. This is displayed in the upper right corner of the application.

2. From the drop-down menu, select Sign Out.

The sign out page displays with the message "You have successfully signed out."