How to filter users for investigation

In the Entities tab, you can use Alert Types and Indicators which are behavioral filters to view high-risk users. The behavioral profile is saved and displayed in the Favorites panel. You can click on the profile in the Favorites to monitor the users. To view users for investigation:

  1. Go to Users > Entities. The Overview tab is displayed.
  2. Click Entities tab.
  3. To create a behavioral filter using alert types, select one or more alerts in the ALERTS drop-down list 4.
  4. To create a behavioral filter using indicators, select one or more indicators in the INDICATORS drop-down list 5. Filter Users for Investigation

Submit Feedback
© 2020 RSA Security LLC or its affiliates. All Rights Reserved.