Interset Brings Reputation Scoring to the World of Insider Threats

The Interset Behavioral Analytics Engine ingests massive amounts of activity data and then uses AI to normalize the activity associated with the data.

The Interset main console (or primary Dashboard) offers a historical view of the level of risk detected by the system. It also summarizes that risk and provides a graphic representation of how risk could potentially affect security.

Use cases are critical policy definitions that can be constructed to identify certain behaviors and then take action on those behaviors. For example, if a user who never accesses an application from an unknown site attempts to launch that application, the use case script will be triggered to block the access.

The platform supports the creation of multiple use cases, allowing operators to create policies for most any event or transaction on the system. Use cases support Boolean logic and can be nested to achieve complex policy interactions.

Interset couples AI with analytics to create usage profiles that are translated into dominant behaviors that are used to classify what is normal or abnormal activity.

One of the key capabilities of the product is its ability to classify behavior and then determine when that behavior falls out of norms. The integrated AI is quickly able to assess if user behavior indicates a potential threat to the enterprise.

Risky behavior is only part of the security equation. Here, Interset also lists what sensitive files are accessed and the history around that access. The collected data can also be used to determine the level of risk and then compare that to the reputation score of the user accessing the files.

Interset’s ability to expose potential threats is based the massive amount of data it collects and generates. An interactive dashboard tracks and tallies multiple data sets to produce a visual representation of system activity.

After it analyzes activity data, Interset builds what the company refers to as “stories” that illustrate the level of trust and the reputation of those accessing data and applications. Using that format, Interset is able to provide actionable information in an easily understood fashion.

Administrators can build custom dashboards to represent critical information using different graphs, triggers and so forth.

A single dashboard can track multiple risk factors, which also supports drilldown and provides antidotal information on the type of risk as well as where the most risk is occurring.

The platform can report risk over customizable time scales, giving a historical view of the level of risk, while providing the ability to drill down into additional stories to provide more insight into the analytics presented on the summary dashboard.

Extensive logging capabilities takes place behind the scenes to enable administrators to delve into the raw data to better understand how information is being processed by the platform as well as to support forensic tasks.