User insights

The User insights panel displays detailed information about specific user activities.

Access the User insights panel by clicking on a user on the Investigation dashboard. The panel expands to display additional information about each activity. These detailed views allow you to analyze and mitigate risks.

1

User risk score: Displays the current risk score of the selected user.

Administrators can also manually edit the user risk score by clicking the edit icon and then selecting the required risk level and the duration during which the set risk score should apply

2

Alerts time line: Displays a time line of all of the user's recent alerts and related policy rules, sorted by day. Click to expand or collapse the alert listing, to display more or less number of alerts for a specific day on the time line. Also, clicking on a specific alert on the time line shows the Alert details. The Alert details, displays the details of the reporting channel, the rule that was matched and the complete details of the alert reported.

3

Time filter: Click the time filter to view the past 30 days, past 7 days, or past 24 hours for all widgets on the User insights dashboard.

4

Alerts summary: Displays the categorized lists of generated alerts.

5

Device usage: Displays the removable device usage statistics for the selected user.

5a

Detected Devices: Displays the removable storage device connected to the endpoint.

5b

Files transferred: Captures the volume of data transferred to and from removable storage devices.

6

Alerts and risk history: Displays the trend of the user risk score and alerts generated for the selected user over the chosen time frame.

7

Data movement: Displays the movement of the user's data by destination or channel during the specified time frame. Click Channel or Destination to filter by channel or destination. When Channel is selected, click a specific channel to view all related alerts and destinations.

8

Detected behavior: Displays the top matched rules for each alert category detected over the specified time frame. Use the drop-down menu category to filter alerts by category.

Per widget User insight details can also be exported to a PDF report using the icon. For more details refer the section Export data from Forcepoint Neo portal.