MITRE D3FENDdefensive technique

D3-JFAPA Job Function Access Pattern Analysis

Official page ↗
Tactic
Detect

Definition

Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department.

How it works

How it works Peer group analysis identifies functionally similar groups of actors (users or resources) based on categorizations such as job title, organizational hierarchy, or other attribute that indicates similarity of job function. Current user access activity is then compared to the appropriate peer group behavior profile to identify anomalies. Considerations Potential for false positives from anomalies that are not associated with malicious activity.

Related

Child of · MITRE D3FEND (1)

  • D3-UBA User Behavior Analysis defensive technique

References