®

One Identity Safeguard
for Privileged Analytics
Detect and prevent security breaches related to privileged accessOverview
As an IT security manager, you know better than
to think your company will never experiencea privileged account breach. Today, it takesorganizations an average of 206 days1 to identify
a breach. And time is money – and risk. So,
whether the breach is from a hijacked privileged
account or an admin gone rogue, the longer itgoes undiscovered, the more time there is for theinfiltrators to find and steal data, and for fines andmore forensic expenses to add up.
You have probably had to provide privileged
access beyond your trusted administrators. Youmight have expanded to include outsourced
admins from outside consultants who could bebased anywhere in the world. So how can you
ensure that admins who have privileged access areusing it for good and not evil?
With One Identity Safeguard for Privileged
Analytics, you know who your most risky users
are, you keep a constant lookout for new internaland external threats, and can detect unusual
privileged behavior. This powerful solution gives
you full visibility into your privileged users andtheir activities, and if there is an issue, you cantake immediate action and be well positioned toprevent data breaches.

1 Ponemon’s 2017 Cost of Data Breach StudyBenefits• Provides insight into what is happening
in your IT system by tracking
and visualizing user activity• Continuous authentication throughconstant analysis of keystroke
dynamics and mouse movements• Identifies unusual deviations frombaseline activity with machine learning• Shortens time to detect a security
incident with contextual information
and risk-based prioritizationof recorded sessions• Reduces the noise of security alerts
so you can focus on what matters• Enhances security by terminating
connections when an alert is thrown
about potentially nefarious activity

Easily determine risky
users and behavior
Quickly see if a user’s activity is unusual andpotentially risky with the analytics summary view.
It contains a summary of unusual commands,
biometric activity, and connection hosts.

Reduce alert noise
Privileged Analytics reduces alert noise generated
by SIEMs by categorizing user events based onrisk and deviation levels, and highlighting the mostsuspicious events. Alerts can be sent to SIEMs or
your security analysts can view a prioritized list of
events on the intuitive user interface, enabling them
to focus on the most important ones.

FeaturesDetect unknown threats in real-timeRules-based security will fail to detect new external
attack methods or malicious insiders. Safeguard
for Privileged Analytics tracks and visualizes user
activity in real-time for a better understanding ofwhat is really happening in your IT environment.
It doesn’t require pre-defined correlation rules; it
simply works with your existing session data.
Pattern free operation
Instead of using pattern-based matching to detect‘known bad’ behavior - which is often incorrect Safeguard for Privileged Analytics uses datacollected from your IT environment. It creates abaseline of ‘normal’ behavior and detects deviations
by using various machine learning algorithms.
Screen content analysis
By analyzing the screen content of privileged
sessions and understanding the issued commands
and window titles Safeguard for Privileged
Analytics can enrich the baseline behavior profileof the regularly used commands and applicationsof your privileged users. This granular analysis
facilitates the identification of typical behavior andthe detection of privileged identity thefts.
Behavioral biometrics
Each user has its own idiosyncratic pattern ofbehavior, even when performing identical actions,such as typing or moving a mouse. The algorithms
built into Safeguard for Privileged Analytics
inspect these behavioral characteristics captured
by Safeguard for Privileged Sessions. Keystroke
dynamics and mouse movement analysis not only
help you identify breaches, but also serve as acontinuous, biometric authentication.

Automated response
In most attack scenarios, high-impact events
are often preceded by a reconnaissance phase.
So, detection and response during this phase iscritical to preventing damaging activity. Seamlessintegration with Safeguard for Privileged Sessions
enables automated session termination whenevera highly suspicious event occurs, or malicious
behavior is detected.

The One Identity approach toprivileged access management
The One Identity portfolio includes the industry’s
most comprehensive set of privileged accessmanagement solutions. You can build on thecapabilities of One Identity Safeguard for Privileged
Analytics with solutions for session and password
management, granular delegation of the UNIX rootaccount and the Active Directory administrator
account; add-ons to make open source sudo
enterprise-ready; and keystroke logging for UNIX
root activities – all tightly integrated with theindustry’s leading Active Directory bridge solution.

About One Identity
One Identity delivers unified identity security
solutions that help customers strengthen theiroverall cybersecurity posture and protect thepeople, applications and data essential to business.
Our Unified Identity Security Platform brings
together best-in-class Identity Governance andAdministration (IGA), Access Management (AM),Privileged Access Management (PAM) and Active
Directory Management (AD Mgmt) capabilities toenable organizations to shift from a fragmented
to a holistic approach to identity security. One
Identity is trusted and proven on a global scale –managing more than 250 million identities for morethan 5,000 organizations worldwide. For more
information, visit www.oneidentity.com.

© 2023 One Identity LLC ALL RIGHTS RESERVED. One Identity, and the One Identity logo are trademarks and registered trademarks of One Identity LLC in the U.S.A. and other countries. For a complete list of One Identity trademarks,
please visit our website at www.oneidentity.com/legal. All other trademarks, servicemarks, registered trademarks, andregistered servicemarks are the property of their respective owners. Datasheet-Safeguard-KA-83750®