RSA Advisor for Admin Threats

ID Plus tenant through administrator logs that are stored within the Sentinel

Datalake. This agent is designed to identify and surface potentially suspicious

activity that could indicate the compromise of an administrator account and/or

a potential insider threat. Utilizing this advisor, security administrators and

analysts can save time, as it automates the process of searching through logs

and correlating events using natural language prompts, resulting in quicker and

more accurate conclusions.

Estimated SCU consumption per execution:

• Small environments: ~0.2 SCUs

(e.g., lower administrative activity and limited event volume ~100 Events )

• Medium environments: ~0.3 SCUs

(e.g., moderate administrative activity and event volume ~200 Events)

• Large environments: ~0.4 SCUs

(e.g., higher administrative activity and larger event volumes ~500 Events)