24 lines
496 B
YAML
24 lines
496 B
YAML
version: "ueba-rule-v1"
|
|
baseline_status: "per_user_department_baseline_skeleton"
|
|
score_cap: 100
|
|
|
|
weights:
|
|
dlp_fail: 35
|
|
dlp_warn: 20
|
|
open_incidents: 15
|
|
night_activity: 20
|
|
weekend_activity: 20
|
|
workforce_drop: 15
|
|
workforce_anomaly: 10
|
|
application_classification_gap: 10
|
|
application_classification_gap_large: 15
|
|
worktime_unavailable: 25
|
|
baseline_deviation: 15
|
|
|
|
confidence:
|
|
base: 0.55
|
|
evidence_bonus: 0.10
|
|
screenshot_bonus: 0.10
|
|
worktime_bonus: 0.15
|
|
policy_bonus: 0.10
|