Reviewing UEBA logs

• Last 24 Hours (default)
• Last 7 Days
• Last 30 Days
• Custom

  If you select Custom, you should select Start Time and End Time to view logs for selected period. You can view logs for a maximum period of 30 days from today.

  It should be mentioned here that the max time period is 30 days from now (the oldest Start Time could be 30 days from now).

  
  
  

1. User Email: Displays the user's Forcepoint ONE SSE user email.
   • Can be filtered by equals, not equals, contains or does not contain and then entering characters or the user's email.
2. Category: Displays the category of observable.
   • Can be filtered by equals and then select the category, that is Data Exfiltration.
3. Observable Name: Displays the name of the Observable matched.
   • Can be filtered by equals, not equals, contains or does not contain and then entering the name of the Observable.
4. Other available filters: You can also filter logs using following filters:
   • Observable ID: Can be filtered by and then entering the Observable ID.
   • Model Name: Can be filtered by equals and then selecting the model name.
   • Baseline: Can be filtered by equals and then entering the baseline.
   • Cadence of Evaluation: Can be filtered by equals and then selecting the cadence. Valid options are Fast, Medium and Slow.

   • Sensitivity: Can be filtered by equals and then selecting the sensitivity. Valid options are High, Medium and Low.

   You can create and save filters as needed. For example, creating a filter where Cadence of Evaluation equals Medium and Sensitivity equals High.

When a user who is not part of IAM > Users and Groups page performs bulk activity for the observables, then such users are termed as Unregistered User: <email>.