Risk Behavior Management

Overview

User Entity Behavior Analysis (UEBA) is a sophisticated security feature that examines user behavior patterns (including natural persons and device entities, collectively referred to as users) within a system to identify anomalies and notify system administrators.

Typical scenarios of abnormal user behavior include: account anomalies, AK anomalies, device anomalies, operational anomalies, host compromise, lateral movement, and more. This document describes how to create and manage risk behaviors across various scenarios, as well as how to receive alert notifications for these risk behaviors.

Note: Currently, only two risk behaviors are supported: unused AKSK and abnormal AKSK calls

Beta release notes

The user entity behavior analysis feature is currently in public beta and available only to accounts on the allow list. To participate in the beta, please contact your key account manager.

Create risk behavior

1. Sign in to the Baidu AI Cloud management console, click the avatar in the upper-right corner, and select Identity and Access Management.
2. Navigate to Identity and Access Management > Anomaly Behavior Analysis > Risk Behavior Management.

Risk behaviors include preset behaviors and custom behaviors:

1. Preset behaviors refer to risk behaviors pre-configured by Baidu AI Cloud, which cannot be edited or deleted. 2. Custom behaviors are those configured by administrators based on actual business requirements for specific scenarios. Compared to preset behaviors, custom behaviors provide finer monitoring detail and more flexible risk behavior content customization.

3. Click Create Behavior.
4. Select a behavior template, enter risk behavior configuration details, click OK, and complete the custom behavior creation.

Managing risk behaviors

1. For preset behaviors, only enabling or disabling the risk behaviors is supported.

2. For custom behaviors, users can enable, disable, edit, or delete risk behaviors.

Alert notification

In Message Center > Message Receipt Settings > Security Messages, user notifications for abnormal behavior have been pre-configured, which supporting five notification channels: SMS, email, in-site messages, DingTalk bot, and WeCom bot. For channel configuration, refer to Message Center.

When abnormal risk behavior is detected, alert notifications will be sent through the configured notification channels.

Note: For AK/SK anomaly alert notifications, only the specific anomalous AK will be notified via email.