Managing attack vectors
Vectors are mechanisms used by PHASR to identify possible attacks and allow the user to reduce the attack surface exposure. Each vector can produce multiple recommendations.
You can access a list of all the vectors currently active that have been applied through PHASR by accessing the PHASR vectors page.
The View options menu. This section provides you with multiple functions for working with smart views:
Save - saves the current smart view with your latest changes
Save as - creates a new smart view based on the current one
Discard changes - reverts all unsaved edits to the last saved version.
Add to favorites - add a saved smart view to your favorites.
Show or hide filters - hide or display the filters menu.
Open settings - displays the Settings panel.
You can use this panel to customize what columns are displayed in the view and enable or disable the Compact view.
The Smart views section. Smart views add a new level of customization to your vectors page. You can create your own customized views or use predefined ones and quickly switch between them as needed.
The Filters section. You can use these options to customize the risks that are displayed in the below table.
The following filters are currently available:
Filtering option
Details
Company
Use the searchable drop-down menu to filter the list of vectors based on the name of the company they belong to.
Only vectors belonging to the selected company are displayed. This filter is available only to Partner type companies.
Vector name
Use the searchable drop-down menu to filter the list of vectors based on their name.
Only selected vectors are displayed.
Vector trigger date
Use the calendar to select two dates.
Only vectors triggered between the selected dates are displayed.
Unrestricted behavioral profile identities
Use the searchable drop-down menu to filter the list of vectors based on the name of the identity they were made for.
Only vectors made for the selected identities are displayed.
Unrestricted behavioral profile resources
Use the searchable drop-down menu to filter the list of vectors based on the name of the resource they were made for.
Only vectors made for the selected resources are displayed.
Targeted activity type
Use the drop-down menu to filter the vectors based on the name of the targeted activity type.
Only vectors targeting the selected activity types are displayed.
The Vectors table. The table displays all active PHASR vectors.
The information available for each findings is displayed under the following columns:
Vector name - The name of the vector.
Clicking on the name displays the Vector details side panel.
Recommendations - The number of recommendations created based on this vector.
Clicking on the values under this column redirects you to the PHASR recommendations page, where the table is automatically filtered to display the recommendations created as a result of triggering the vector.
Vector trigger date - This shows the most recent date and time when the vector was triggered.
Targeted activity type - The type of activity the vector applies to.
Vector triggers - The number of events that triggered this vector.
Clicking on the name displays the Vector triggers side panel.
Unrestricted behavioral profiles - The number of behavioral profiles that this vector applies to.
Clicking on the icon under the column displays the Behavioral Profiles side panel, where a full list of users and devices is displayed.
Note
This section lists the profiles discovered by PHASR so far. However, this does not mean that their learning process has finished. New profiles may also be added as the system continues to collect and analyze data.
Restricted behavioral profiles - The number of behavioral profiles that are restricted access to, based on this vector.
Clicking on the icon under the column displays the Behavioral Profiles side panel, where a full list of users and devices is displayed.
Company - The company the vectors belong to.
Note
More details regarding the information in each column are available type in the Filters section.
Actions menu - Clicking on the inline menu button displays a list of actions available for the recommendation:
View/edit access - This option will display the Edit Access window, where you can view and restrict or allow access to behavioral profiles.
Viewing vectors details
You can view additional information regarding a vector by opening the Vector details side panel. To open the side panel, click the name of the vector under the Vector name column:
General - this section contains the following information:
Target activity type - The type of activity targeted by the vector.
Vector trigger date - The date and time when the vector was last triggered.
Vector triggers - The number of events that triggered this vector.
Clicking on the name displays the Vector triggers side panel.
Recommendations - The number of recommendations created based on this vector.
Clicking on the values under this column redirects you to the PHASR recommendations page, where the table is automatically filtered to display the recommendations created as a result of triggering the vector.
Behavioral profiles - The number of behavioral profiles that this recommendation applies to.
Clicking on the icon under the column displays the Behavioral Profiles side panel, where a full list of users and devices is displayed.
Restricted behavioral profiles - The number of behavioral profiles that are restricted access to, based on this vector.
Clicking on the icon under the column displays the Behavioral Profiles side panel, where a full list of users and devices is displayed.
Incidents involving vector triggers - A list of incidents opened as a result of this vector triggering.
Clicking on the associated incident name opens the Graph tab under the Incidents page in a new browser tab.
Vector description - Provide a description on what the vector is and how it applies.
The action button - Depending on the status of the recommendation this button will allow you to Restrict access.
Viewing and editing access
To edit the access to behavioral profiles for a specific vector, follow these steps:
Go to the PHASR vectors page.
Locate the vector you want to change access for, and select it's name under the Vector name column.
The Vector details side panel is displayed.
Select Edit access.
The Edit access window is displayed.
Under the Behavioral profiles section, configure the departments, users, or devices for which you wish to restrict or allow access.
Restrictions that were applied using recommendations can be also be removed from vectors.
Note
PHASR retrieves department information from the Active Directory "Department" field and displays it in the console only for monitored users. This applies if the machine has AD access and the user's department is defined. If the field is empty or AD isn't accessible, the department won't be shown, and the user will be displayed under an Unassigned group in the Recommendations or Vectors sections.
Select Edit access to apply your changes.
Viewing vector triggers
To view additional details on the events that occurred when a vector was triggered, follow these steps:
Go to the PHASR vectors page.
Locate the vector you want to change access for, and select the number displayed under the Vector traiggers column.
The Vector Vector triggers side panel is displayed.
The sidepanel contains information on each event where the vector was triggered:
Timestamp - The time and date when the vector was triggered.
Username - The username that triggered the vector.
Hostname - The host name of the endpoint where the vector was triggered.
Incidents - The incident that was created as a result of triggering the vector.
Clicking on the associated incident name opens the Graph tab under the Incidents page in a new browser tab.