Flyer

ArcSight Intelligence Behavioral Analytics
ArcSight Intelligence behavioral analytics gives you a new lensthrough which to detect, investigate, and respond to threats that
may be hiding in your enterprise—before your data is stolen.
Using machine learning, ArcSight Intelligenceby OpenText™ distills billions of events into aprioritized list of high-quality leads to focus
and accelerate the efforts of your security
operations center (SOC). ArcSight Intelligence’s
machine learning models, combined with ahighly intuitive user interface (UI), acceleratethreat detection and investigation, drasticallyreducing attacker dwell time.

Why ArcSight Intelligence

Many organizations have important assets toprotect, whether it is customer information,
intellectual property, critical infrastructure
controls, or all of the above. Unfortunately,
existing approaches to protecting theseassets from advanced threats frequently
fall short, leaving security teams to contend
with rigid, rules-based analytics, fragmented
security ecosystems, and a never-ending
barrage of alerts—most of which are false
alarms. Meanwhile, these teams are expected
to flawlessly protect against critical threatslike data exfiltration and unauthorizednetwork access.
ArcSight Intelligence is uniquely positioned
to find the threats that matter for enterprises
with valuable data to protect, limited security
or financial resources, and significant surface
area to monitor. Unlike other solutions,
ArcSight Intelligence goes beyond traditional
rule and threshold based detection and instead
assesses the potential risk of a user or entity
in your enterprise based on mathematicalprobability and online unsupervised machinelearning models. This approach, combinedwith ArcSight Intelligence’s native big-dataarchitecture, allows your security team todetect threats with speed and at scale.

Detect. Investigate. Respond.
Utilize theSECURITY DATA
you already collect…

to expose
ADVANCED THREATS
hiding in your organization…

EDR

and help security teams
STOP ATTACKS
before damage can be done.

Normalized Risk

ActiveDirectory
AccessWeb Proxy

Extreme

Data
Normalization

Behavior
Analytics
using ML&Entity
Resolution

High
Medium
450+models
Low

And more…

Anomaly
Alerts&Threat
Hunting
Leads

Orchestration
Automation
ReportingFigure 1. ArcSight Intelligence views your existing security data through a new lens in order to identify
advanced threats (such as novel attacks, low and slow attacks, and insider threats) by looking for anomalous
behavior. This produces high-quality threat leads, allowing your security teams to respond and remediate
quickly and effectively.

Using unsupervised machine learning—a typeof artificial intelligence (AI) that doesn’t needpre-labeled datasets—ArcSight Intelligence’s
algorithms extract available entities (users,machines, IP addresses, servers, etc.) fromwithin log files and observe events thatinvolve these entities to determine expectedbehavior—a measurement we call “uniquenormal.” As new information comes throughthe analytics process, events are evaluatedThreat Detection Use Cases!

!

Insider Threat

Data Breach

Advanced Threat

IP Theft• At-Risk employee• High-Risk Employees• Account Misuse• Privilege Account
Misuse• Terminated Employee
Activity• Data Staging• Data Exfiltration• Network Exfiltration• USB Exfiltration• Unusual data access• Unusual uploads• Compromised Account• Internal Recon• Unusual Traffic• Abnormal Processes• Unusual Applications• Infected Host• Malicious Tunneling• Bot Detection• Interactions with dormant
resources/files• High Risk IP/Data Access• Lateral Movement

Figure 2. ArcSight Intelligence uses advanced mathematical algorithms to constantly mine billions of data
points and reveal indicators of insider threats, data breaches, advanced persistent threats (APT), IP theft,and more.

1

against previously observed behavior toassess potential risk.
With this process of baselining and scoring,
ArcSight Intelligence boosts the efficiency
and speed at which security teams
detect, triage, investigate, and respondto threats. ArcSight Intelligence’s output
risk assessments can be used to initiate
actions via automation, orchestration, andalerting solutions to execute faster-thanhuman actions as risks are found. ArcSight
Intelligence also provides downloadable
reports summarizing immediateorganizational risks.
1. View all entities within the enterprise withanalytics to display, grouped by entity type.
The screenshot shows a list of users, with apresentation that displays them in order ofrisk score from highest to lowest.

Viewing Risky Entities

As a security practitioner, your primarymechanism for interacting with ArcSight
Intelligence is the intuitive, web-based
dashboard. ArcSight Intelligence’s dashboard
allows users to quickly and easily determine
which entities represent the greatest
potential risk. As risky entities are identified,the dashboard allows you to explore a timeline of events so that the potential risk can beunderstood in the context of the generated
alerts and, if desired, the raw events that
produced them. The screenshots below
show a drilldown from the list of riskiest
users down to the raw events.
seen below the timeline view. They canbe filtered by associated entities andtypes of risk and, because they display inchronological order linked to the timelineview, it is simple to see a narrative of theunfolding behavior in the context ofother events.

described in detail. Note that the user’s
baseline is compared to both itself, as wellas to other similar entities. These similar
entities are identified through statisticallydetermined peer groups.

5. The raw events that triggered an alert
are only one click away. In addition toseeing the actual contents of the log file
responsible for the analytics, users havethe ability to enter additional queries using
this interface.

2. When any entity is viewed, its risk scoreover time is displayed in a timeline view.
This perspective shows not only the change
in risk score, but also broadly characterizes
the types of behavior that drove it.

3. When viewing an entity, a display of thealerts associated with the entity can beConnect with Us
www.opentext.com

4. Clicking on any of the alerts allows for
examination that shows the event incontext of the user’s baseline and otherrelevant entities in the enterprise. The risk
associated with the alert is displayed,
and the model that triggered the alert isTable 1. Screenshots of the ArcSight Intelligence dashboard showing navigation through the analytical results

OpenTextCybersecurityprovidescomprehensivesecuritysolutionsforcompaniesandpartnersofallsizes.Fromprevention,detectionandresponsetorecovery,investigationandcompliance,
our unified end-to-end platform helps customers build cyber resilience via a holistic security portfolio. Powered by actionable insights from our real-time and contextual threat intelligence,
OpenText Cybersecurity customers benefit from high efficacy products, a compliant experience and simplified security to help manage business risk.
761-000012-005 | O | 01/24 | © 2024 Open Text