Identity risks
The Identity risks page displays all risks caused by the reckless or unintentional actions of active identities, or lack of measures taken to properly secure their working sessions while in your network. It provides detailed information of the severity level, number of vulnerable identities, risk status and type.
Note
For more details on how we process identity data, refer to Identity risk data collection.
The Smart views panel. This feature allows you to customize, save, and switch between different loadouts of the Identity risks page.
The panel has the following sections:
Search views - Use this search field to filter out the views displayed in the sections below, by name.
Saved - This section displays a list of all your saved views that have not been marked as favorites.
Favorites - All views marked as favorites are displayed under this section.
Defaults - This section displays the views that are available by default:
All identity risks
High severity
Detected
Ignored
Watchlist
For any view in the Saved or Favorites category, you can click the vertical ellipses
to Rename or Delete the view.The Identity risk actions. This section contains the buttons to all the available actions you can take on the selected risks on the page:
State - Change the state of the selected risks. The following options are available:
Ignore risks - The selected identity risk will be excluded from the overall risk score calculation for identities, resources, and the company's total risk score. The selected risks are added to the Ignored smart view.
Restore ignored risks - The selected identity risk will be included in the overall risk score calculation for identities, resources, and the company's total risk score. The selected risks are removed from the Ignored smart view.
Watchlist - Add or remove the selected risks from your watchlist. The following options are available:
Add to watchlist - The selected risks are added to the Watchlist smart view.
Remove from watchlist - The selected risks are removed from the Watchlist smart view.
Scan - Perform a scan to check for new risks or updates on known risks.
The Filters section. You can use these options to customize the risks that are displayed in the grid.
The following filters are currently available:
Filtering option
Details
Identity risk name
Use the searchable drop-down menu to filter the list of identity risks by name. Select the identity risks you want to display and click Apply.
Only the selected identity risks are displayed.
Risk score
Select a risk score range between 1 and 100.
Only identity risks with a risk score between these values are displayed.
Mitigation type
Use the searchable drop-down menu to filter the list of identity risks by mitigation type. Select the mitigation types you want and click Apply. Possible values:
Manual
Automatic
Only identity risks where the types of mitigation you selected applies are displayed.
Vulnerable identities
Use the searchable drop-down menu to filter the list of identity risks by the vulnerable identities they affect. Select the identities you want and click Apply.
Only identity risks that apply to the selected identities are displayed.
Platform
Use the searchable drop-down menu to filter the list of identity risks by the platform to which these identity risks apply. Select the operating systems you want and click Apply. Possible options:
Unknown
IOS
Android
Windows
Linux
Solaris
Mac OS X
Container
Only identity risks that apply on the selected operating systems are displayed.
Status
Use the searchable drop-down menu to filter the list of identity risks by status. Select the statuses you want and click Apply. Possible values:
Compliant
Detected
Only identity risks with the statuses you selected are displayed.
State
This filter allows you to filter the list of indicators of risk by their status, Active or Ignored.
Use the searchable drop-down menu to filter the list of identity risks by state. Select the states you want and click Apply. Possible states:
Active
Ignored
Only identity risks with the states you selected are displayed.
Compliance standard
Select the Compliance Standard you want to display the identity risks for.
Only findings resulted from checks based on rules belonging to the compliance standards you selected are displayed.
In watchlist
Use this filter to display identity risks based on them currently being included in a watchlist.
The View options menu. This section provides you with multiple functions for working with views:
Save - Save changes you make to a saved view.
Save as - Save a modified view under a different name.
Discard changes - Revert the saved view to its original state.
Export view - Download the information in a
CSVfile, which can contain up to 1500 rows.Add to favorites - Add the view to the Favorites category.
Show or hide filters - Hide or display the filters menu.
Open settings - Display the Settings panel.
You can use this panel to customize what columns are displayed in the view and enable or disable the Compact view.
The Identity risks grid. The grid displays all known identity risks in your company, based on your last scan.
The information available for each identity risk displayed under the following columns:
Identity risk - The name of the identity risk.
Risk score - The risk score of the identity risk. Hovering over the score displays a breakdown of how it was calculated.
Vulnerable identities - Displays the number of identities that the identity risk applies to, grouped by type (local or AD).
Platform - The type of operating system where the identity risk was detected.
Mitigation type - The type of mitigation that can be applied to this identity risk.
Status - The status of the identity risk.
State - The state of the identity risk.
Compliance standard - The compliance standards corresponding to the check that resulted in the detection of the identity risk.
In watchlist - Indicates if the identity risks currently in the watchlist.
Note
More details regarding the information in each column are available type in the Filters section.
Actions button - The
Actions button at the right of each identity risk row, enables you to take the necessary actions: Ignore risk
Restore ignored risk
Add to watchlist
Remove from watchlist
View additional information
Selecting an entry opens a side panel with additional details about a specific finding. Depending on where you click, a different panel is available.
Main side panel
The main side panel opens when clicking anywhere on an identity risk row, except the checkbox and the Vulnerable identities value.
The panel displays specific information that varies based on the type of risk and the related data available.
General
This section contains general information regarding the risk:
Risk score - The risk score of the identity risk.
Status - The status of the identity risk.
State - The state of the identity risk.
Platform - The type of operating system that is affected by the identity risk.
Mitigation type - The type of mitigation that can be applied to this identity risk.
Compliance standard - The compliance standards corresponding to the check that resulted in the detection of the finding.
In watchlist - Indicates if the identity risk is currently in the watchlist.
Additionally, the following actions are available:
View identities - This link takes you to the Identities page, where it displays all the identities that this risk applies to.
Add to watchlist - Add this risk to your watchlist.
Details
This section outlines the requirements and verification processes involved in conducting the check that identified this identity risk.
Risk mitigation
This section provides information on the steps required to fix the risk.
Additionally, the following options are available:
Ignore risk - Ignore the selected risk.
Identities
This section provides you with a list of identities where this risk has been detected.
Compliance standards
This section provides you with a list of security standards on which the scan is based, along with the sections and subsections the security requirement can be found under.
Vulnerable identities panel
Clicking the Affected resources value of a vulnerability opens a side panel that lists all resources affected by the risk.
In this panel, clicking the More options button next to any resource will provide you with the available actions you can take further:
View identity - This option opens the Identities page in a new tab, where filters will be automatically configured to display only the selected identity.
View incidents - This option opens the Incidents page in a new tab, where filters will be automatically configured to display all incidents where this identity was involved.