Figure ?? : Example schedule of complex thresholds Partial view of a longer schedule that has many more user event definitions Response Actions - Schedule of Thresholds Overall Number of Security Events Code Series Threshold Period Responses (All) - 5 1 day ASR-E (All) - 45 1 day ASR-E, ASR-J, ASR-K System Trends (individual detection points) Code Series Threshold Period Responses STE1 1000 +500% 15 minutes ASR-B STE2 1000 +1000% 1 hour ASR-B User Trends (individual detection points) Code Series Threshold Period Responses UT1 1000 10 1 hour ASR-B UT1 2010 5 15 minutes ASR-B, ASR-E UT1 2020 40 1 day ASR-B, ASR-E, ASR-I UT3 1000 1 - ASR-D UT3 2000 1 - ASR-B, ASR-I User Events (individual detection points) Code Series Threshold Period RE1 1000 2 1 hour
Figure ?? : Example schedule of complex thresholds Partial view of a longer schedule that has many more user event definitions Response Actions - Schedule of Thresholds Overall Number of Security Events Code (All) (All) Series - - Threshold 5 45 Period 1 day 1 day Responses ASR-E ASR-E, ASR-J, ASR-K System Trends (individual detection points) Code STE1 STE2 Series 1000 1000 Threshold +500% +1000% Period 15 minutes 1 hour Responses ASR-B ASR-B User Trends (individual detection points) Code UT1 UT1 UT1 UT3 UT3 Series 1000 2010 2020 1000 2000 Threshold 10 5 40 1 1 Period 1 hour 15 minutes 1 day - - Responses ASR-B ASR-B, ASR-E ASR-B, ASR-E, ASR-I ASR-D ASR-B, ASR-I User Events (individual detection points) Code RE1 Series 1000 Threshold 2 Period 1 hour
Owasp-appsensor2-1v25.docx