Suspect Entities

Client Tools Guide › Audit Menu › Generate and Manage AuditCards › Suspect Entities

Suspect Entities

This tab is used to set the client tools to identify suspect entities. In the case of users these are users that have an extraordinarily different access to resources relative to their peers. In the case of resources or roles, these are resources or roles for which there is no clear pattern by which they are connected to users. To identify such exceptions to the rule you must enter a value for the conditions used to list the exceptions.

Using the minimum standard deviation (Min STD) condition on the tab you set a boundary that is used as the minimum threshold for identifying the exceptional cases. Any entity that lies above the threshold is considered as an exception.

Using the Max % condition you set a boundary that is used to set an upper threshold that lists to upper X% of all exceptions identified.

You can use each condition exclusively or in combination. In any case the client tools list the alerts in the audit card according to the condition that provides the fewest alerts.

The fields are described in the following table:

Option	Description
Users (Collectors)	Mark users to include users in the output. Unmark users not to include users in the output. Min STD - Limits the maximum number of users displayed to no more than the indicated absolute number thereby preventing the display of an unmanageable number of suspects. Max % - The maximum percentage of users to display out of all those who meet the criteria.
Resources (Collectibles)	Mark resources to include users in the output. Unmark resources not to include users in the output. Min STD - Limits the maximum number of resources displayed to no more than the indicated absolute number thereby preventing the display of an unmanageable number of suspects. Max % - The maximum percentage of resources to display out of all those who meet the criteria.
Suspect Roles	Mark roles to include users in the output. Unmark roles not to include users in the output. Min STD - Limits the maximum number of roles displayed to no more than the indicated absolute number thereby preventing the display of an unmanageable number of suspects. Max % - The maximum percentage of suspect roles to display out of all those who meet the criteria.

Option

Description

Users (Collectors)

Mark users to include users in the output.

Unmark users not to include users in the output.

Min STD - Limits the maximum number of users displayed to no more than the indicated absolute number thereby preventing the display of an unmanageable number of suspects.

Max % - The maximum percentage of users to display out of all those who meet the criteria.

Resources (Collectibles)

Mark resources to include users in the output.

Unmark resources not to include users in the output.

Min STD - Limits the maximum number of resources displayed to no more than the indicated absolute number thereby preventing the display of an unmanageable number of suspects.

Max % - The maximum percentage of resources to display out of all those who meet the criteria.

Suspect Roles

Mark roles to include users in the output.

Unmark roles not to include users in the output.

Min STD - Limits the maximum number of roles displayed to no more than the indicated absolute number thereby preventing the display of an unmanageable number of suspects.

Max % - The maximum percentage of suspect roles to display out of all those who meet the criteria.