Suspicious Time
Description
Suspicious Time policy monitors cloud account activities outside of regular working hours.
Policy Configuration
Follow the steps below to enable and configure the policy
- Click on any Cloud Account drop down menu from FortiCASB dashboard, e.g. Salesforce, Office365, etc.
- Click on Policy drop down menu and select Threat Protection.
- Locate Suspicious Time and click on the right arrow key > button to expand the policy.
- Click on General tab, click Status toggle switch button to enable the policy.
- Click on Severity level drop down menu to select the severity level (Critical, Alert, Warning, Information).
- Click Context tab to configure settings.
- In Event section, click to select Specific events then click the drop down field under it to select specific event(s). To select all events instead, click on Select all events.
- In Suspicious Time section, click on Select day in week drop down menu to select a day in the week to monitor for suspicious event. Then enter the beginning and end time of the day to monitor the event.
- Click Save to update the configuration.
|
After the policy is enabled and configured, whenever the specific activity is conducted in the suspicions time frame during the target day of the week, an alert will be triggered in the alert page. For more details, please refer to Alert. |