Run Analytics

Autonomous Identity administrators must conduct various tasks to run analytics.

The following are the basic tasks to run the analytics pipeline:

Ingest the data files

At this point, you should have set your data sources and configured your attribute mappings. You can now run the initial analytics job to import the data into the Cassandra or MongoDB database.

Run ingest using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Ingest, and then click Next.
On the New Ingest Job box, enter the name of the job, and then select the data source file.
Click Advanced and adjust any of the Spark properties, if necessary:
- Driver Memory (GB)
- Driver Cores
- Executor Memory (GB)
- Executor Cores
Click Save to continue.
Click one of the following commands:
1. If you need to edit any of the job settings, click Edit.
2. If you want to remove the job from your Jobs page, click Delete job.
Click Run Now to start the ingestion run.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status appears.

Click an example

Run training

After you have ingested the data into Autonomous Identity, start the training run.

Training involves two steps:

Autonomous Identity starts an initial machine learning run where it analyzes the data and produces association rules, which are relationships discovered within your large set of data. In a typical deployment, you can have several million generated rules. The training process can take time depending on the size of your data set.
Each of these rules are mapped from the user attributes to the entitlements and assigned a confidence score.

The initial training run may take time as it goes through the analysis process. Once it completes, it saves the results directly to the database.

Run training using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Training, and then click Next.
On the New Training Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click Run Now.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status is displayed.

Click an example

Run recommendations

During the second phase of the predictions process, the recommendations process analyzes each employee who may not have a particular entitlement and predicts the access rights that they should have according to their high confidence score justifications. These rules will then be displayed in the UI and saved directly to the database.

Run predict-recommendation using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Predict-Recommendation, and then click Next.
On the New Predict-Recommendation Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click Run Now.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status appears.

Click an example

Run as-is predictions

After your initial training run, the association rules are saved to disk. The next phase is to use these rules as a basis for the predictions module.

The predictions module is comprised of two different processes:

as-is. During the As-Is Prediction process, confidence scores are assigned to the entitlements that users currently have. The as-is process maps the highest confidence score to the highest freqUnion rule for each user-entitlement access. These rules will then be displayed in the UI and saved directly to the database.
Recommendations. Refer to Run recommendations.

Run predict as-is using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Predict-As-Is, and then click Next.
On the New Predict-As-Is Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click Run Now.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status is displayed.

Click an example

Publish the analytics data

Populate the output of the training, predictions, and recommendation runs to a large table with all assignments and justifications for each assignment. The table data is then pushed to the Cassandra or MongoDB backend.

Run publish using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Publish, and then click Next.
On the New Publish Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click one of the following commands:
Click Run Now.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status appears.

Click an example

Create assignment index

Next, run the create-assignment-index job. This command creates a master index by joining together all database tables. The combined index becomes a source index for the APIs.

Run create-assignment-index using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Create Assignment Index, and then click Next.
On the New Create Assignment Index Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click Run Now.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status appears.

Click an example

The create-assignment-index-report is an export of the assignment index to a csv file. This allows users to create custom reports from the master table.

Run insight report

Next, run an insight report on the generated rules and predictions that were generated during the training and predictions runs. The analytics command generates insight_report.txt and insight_report.xlsx and writes them to the /data/input/spark_runs/reports directory.

The report provides the following insights:

Total number of assignments received, scored, and unscored.
Total number of valid assignments received.
Total number of invalid assignments received.
Total number of assignments received, scored, and unscored.
Number of entitlements received, scored, and unscored.
Number of assignments scored greater than 80% and less than 5%.
Distribution of assignment confidence scores.
List of the high volume, high average confidence entitlements.
List of the high volume, low average confidence entitlements.
Top 25 users with more than 10 entitlements.
Top 25 users with more than 10 entitlements and confidence scores greater than 80%.
Top 25 users with more than 10 entitlements and confidence scores less than 5%.
Breakdown of all applications and confidence scores of their assignments.
Supervisors with most employees and confidence scores of their assignments.
Top 50 role owners by number of assignments.
List of the "Golden Rules," high confidence justifications that apply to a large volume of people.

Run the insight report using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Insight, and then click Next.
On the New Insight Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click Run Now.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status appears.
Access the insight report. The report is available at /data/output/reports/insight_report.xlsx.

Run anomaly report

Autonomous Identity provides a report on any anomalous entitlement assignments that have a low confidence score but are for entitlements that have a high average confidence score. The report’s purpose is to identify true anomalies rather than poorly managed entitlements.

The report generates the following points:

Identifies potential anomalous assignments.
Identifies the number of users who fall below a low confidence score threshold. For example, if 100 people all have low confidence score assignments to the same entitlement, then it is likely not an anomaly. The entitlement is either missing data or the assignment is poorly managed.

Run the anomaly report using the UI:

On the Autonomous Identity UI, click the Administration link, and then click Jobs.
On the Jobs page, click New Job. Autonomous Identity displays a job schedule with each job in the analytics pipeline.
Click Anomaly, and then click Next.
On the New Anomaly Job box, enter the name of the job.
Click Advanced and adjust any of the Spark properties, if necessary.
Click Save to continue.
Click Run Now to start the ingestion run.
Next monitor the state of the job by clicking Logs, or click Refresh to update the Jobs page.
When the job completes, the change in the status appears.
Access the anomaly report. The report is available at /data/output/reports/anomaly_report/<report-id>.csv.

Autonomous Identity 2022.11.11