Skip to main content

Managing recommendations

You can find a list of all PHASR recommendations under the PHASR recommendations page.

PHASR_recommendations_page_981499_en.png
  1. The View options menu. This section provides you with multiple functions for working with views:

    • Reset view - Revert the saved view to its original state.

    • Show or hide filters - Hide or display the filters menu.

    • Open settings - Display the Settings panel.

      You can use this panel to customize what columns are displayed in the view and enable or disable the Compact view.

  2. The Filters section. You can use these options to customize the risks that are displayed in the below grid.

    The following filters are currently available:

    Filtering option

    Details

    Company

    Use the searchable drop-down menu to filter the list of recommendations based on the name of the company they belong to.

    Only recommendations belonging to the selected company are displayed. This filter is available only to Partner type companies.

    Name

    Use the searchable drop-down menu to filter the list of recommendations based on their name.

    Only selected recommendations are displayed.

    Created on

    Use the calendar to select two dates.

    Only recommendations created between the selected dates are displayed.

    Behavioral profile identities

    Use the searchable drop-down menu to filter the list of recommendations based on the name of the identity they were made for.

    Only recommendations made for the selected identities are displayed.

    Behavioral profile resources

    Use the searchable drop-down menu to filter the list of recommendations based on the name of the resource they were made for.

    Only recommendations made for the selected resources are displayed.

    Targeted activity type

    Use the drop-down menu to filter the recommendations based on the name of the targeted activity type.

    Only recommendations targeting the selected activity types are displayed.

    Action taken

    Use the drop-down menu to filter the recommendations based on the action they recommend to be taken.

    Only recommendations that suggest the selected actions be taken are displayed.

  3. The Recommendations grid. The grid displays all known PHASR recommendations, based on the PHASR learning phase.

    The information available for each findings is displayed under the following columns:

    • Name - The name of the recommendation.

    • Attack surface reduction - Indicates the impact applying the recommendation would have on the total attack surface.

    • Created on - The time and date when the recommendation was created.

    • Description - A description for the recommendations.

    • Target activity type - The type of activity targeted by the recommendation.

      Possible values:

      • Tampering tools

      • Living of the Land Binaries

      • CryptoMiners

      • Remote admin tools

      • Piracy tools

    • Monitored rule - Displays the rule name that was used to generate the recommendation. This column can be hidden.

    • Behavioral profiles - The total number of profiles affected by the vulnerability covered by the recommendation. The column displays a maximum of 9999 items, with the exact count displayed when hovering over the icon.

      Clicking the behavioral profiles icon in the grid opens the Behavioral profiles side panel, which lists the behavioral profiles for which this recommendation was generated.

    • Action taken - The action that was taken as a result of the recommendation.

      Possible values:

      • Action needed

      • Applied

      • Partially applied

    • Company - The company where the recommendation was made.

    Note

    More details regarding the information in each column are available type in the Filters section.

  4. Actions menu - Clicking on the inline menu button displays a list of actions available for the recommendation:

    • Restrict access - This option will automatically apply the actions suggested by the recommendation and restrict access for the selected users to the recommended asset. The Action taken field associated with the recommendation will change to Applied or Partially applied.

    • Allow access - This option will automatically apply the actions suggested by the recommendation and allow access for the selected users to the recommended asset. The Action taken field associated with the recommendation will change to Applied or Partially applied.

Restricting access based on a received recommendation

When PHASR detects that user behavior has changed for a user which currently has access to certain assets, it will generate an Restrict access recommendation. Once this recommendation is generated you can review the behavioral profiles for which it was generated and allow the recommendation to by applied.

You can restrict access based on a specific recommendations by using on of these methods:

  • Click the menu button on the right side of the Recommendations grid and select Restrict access.

  • Click the name of the recommendation under the Name column and select Restrict access from the displayed details side bar.

This will display the Restrict access window:

PHASR_remove_access_recommendation_981499_en.png

You can restrict access for an entire department, for specific users, or for specific users on specific devices using the checkboxes available in the Behavioral profiles section.

Select Apply to save your changes.

Allowing access based on a received recommendation

When PHASR detects that user behavior has changed for a user which previously had its access restricted, it may generate an Allow access recommendation. Once this recommendation is generated you can review the behavioral profiles for which it was generated and allow the recommendation to by applied.

You can restrict access based on a specific recommendations by using on of these methods:

  • Click the menu button on the right side of the Recommendations grid and select Allow access.

  • Click the name of the recommendation under the Name column and select Allow access from the displayed details side bar.

After selecting Allow access, the Allow access window is displayed.

PHASR_allow_access_recommendation_981499_en.png

You can allowaccess for an entire department, for specific users, or for specific users on specific devices using the checkboxes available in the Behavioral profiles section.

Select Apply to save your changes.

Viewing recommendation details

You can view additional information regarding a recommendation by opening the Recommendation details side panel. To open the side panel, click the name of the recommendation under the Name column:

PHASR_recommendations_sidebar_981499_en.png
  • General - this section contains the following information:

    • Target activity type - The type of activity targeted by the recommendation.

    • Attack surface reduction - Indicates the impact applying the recommendation would have on the total attack surface.

    • Created on - The time and date when the recommendation was created.

    • Monitored rule - Displays the rule name that was used to generate the recommendation.

    • Behavioral profiles - Displays the total number of profiles for recommendation.

    • Action taken - The action that was taken as a result of the recommendation.

  • Details - This section provides a written description of the vulnerability and how it can be exploited

  • Recommendation mitigation - The action suggested to fix the vulnerability.

  • The action button - Depending on the status of the recommendation this button will allow you to Restrict access.