To access the Top 20 High Risk Users chart, go to Monitoring > Threat Protection.

A screen capture of the Top 20 High Risk Users chart. The chart shows two columns: the unique user identifier and the respective number of high-risk events. Below the chart is the drill-down table.

The drill-down table shows more detailed information about each risk evaluation event for the user, such as IP address and target application.

Scroll to the right to see additional columns. For use of the filtered search bar, see Filtered searching.

You can click a column header to sort the results by that value. Results are sorted by the Time column by default, with the most recent entries listed first.