To access the Top 20 High Risk Users chart, go to Monitoring > Threat Protection.

Click on the dashboard to view drill-down information.


A screen capture of the Top 20 High Risk Users chart. The chart shows two columns: the unique user identifier and the respective number of high-risk events. Below the chart is the drill-down table.

The drill-down table shows more detailed information about each user, including:

  • IP address
  • Target application
  • IP reputation

Scroll to the right to see additional columns. Only events that have triggered a specific risk model, such as geovelocity anomaly, or have an aggregated risk score of high are shown. The aggregated risk score is determined by the selected risk policies in the Policy Name list.

Scroll to the right to see additional columns. For use of the filtered search bar, see Filtered searching.

For a description of the table columns, see Monitored risk data.

You can click a column header to sort the results by that value. Results are sorted by the Time column by default, with the most recent entries listed first.