Lepide Community
In our industry we have very different fileserver events for office user,user from technology or user from projection and others positions examplewhere is used CAD software or other special software. If we have project inCAD software, project created, deleted, renamed more files in one time,then is very difficult to set count of events and separate normal officeuser and other with static thread model. Then we have many false positiveevents and alerts for ransomware or also when we set thread model manuallyaccording operations.Currently LDSP contains static model for ransomware alert in part threadmodel or change alerts. There can be set operation, their count and timeinterval.We expect some new UEBA function for counting of user operations in userbehaviour.With new learning of user behaviour we expect, how many operations read,write..... user do daily, weekly, monthly for each user. It calculates somestatistic of user behaviour according operations also do some mathoperation minimum, maximum, average, 95 percentil value for learning perioddaily, weekly, montly in 90 days learning mode for each operations in fileserver. It can help with alerting of user operations example accordingaverage value of count of renamed files, 95 percentil.... If there will bealso some parametr as +-/tolerance it should be also good. Ransomware isanomally behaviour, I hope that alert according users behaviour ofoperations can minimalize false possitive and increace success rate.These operations can use some performance but I hope that it can providemore variants than static model. Do you have my point?User A – example for read operationsMinimum read operations daily, weekly, montly for 90 learning daysMaximum read operations daily, weekly, montly for 90 learning daysAverage read operations daily, weekly, montly for 90 learning days95 percentil ……Set alertOperation:read – x operations/this value is according average of readoperations weekly in 90 learning days operations at condition per 1 minute