CaveloInstall

Summary

Detect anomalies in access audit logs based on selected anomaly types and sensitivity, optionally including detailed behavioral analysis and user profiling.

Inputs

• Anomaly Types (required) — Select one or more types of anomalies to detect among behavioral, temporal, volume, and geographic anomalies.
• Anomaly Sensitivity (required) — Set the detection sensitivity level to high, medium, or low to control the threshold for flagging anomalies.
• Include Behavioral Analysis — Boolean flag to include detailed behavioral analysis and user profiling in the results.
• Baseline Period (Days) — Number of days to establish a behavioral baseline for user profiling, used when behavioral analysis is included.

Output shape

a list of access audit records with anomaly detection scores and classifications

Each returned record includes an overall anomaly score, classification (normal, suspicious, or anomalous), binary indicators for each anomaly type detected, and if enabled, a detailed behavioral analysis including user profile, deviation score, and recommendations. Results are limited by the 'limit' parameter (default 100). No pagination is indicated.

Examples

Example 1: Detect behavioral and temporal anomalies with medium sensitivity and behavioral analysis included.

Set Anomaly Types to 'Behavioral Anomalies' and 'Temporal Anomalies'; set Anomaly Sensitivity to 'Medium'; keep 'Include Behavioral Analysis' checked; specify Baseline Period as desired (default 30 days).

Example 2: Detect all anomaly types with high sensitivity and no behavioral analysis.

Select all anomaly types; set Anomaly Sensitivity to 'High'; set 'Include Behavioral Analysis' to false; set Baseline Period as needed.