AI-based anomaly detection in Log360

Establish behavioral baselines for every user and entity

Before you can detect what’s abnormal, you need to know what’s normal. Log360’s UEBA builds individual profiles for every user, device, IP address, and application in your environment, then flags deviations that signal risk.

• Per-entity baselines: Log360 models each user’s and entity’s typical behavior, logon hours, access patterns, data volumes, and application usage, so deviations stand out precisely rather than noisily.
• Peer group comparison: Activity is evaluated not just against an entity’s own history but against its peer group (e.g., a finance user’s behavior compared to other finance users), catching privilege abuse that looks normal in isolation.
• Risk scoring on every entity: Each user and device carries a dynamic risk score, continuously updated as new behavioral signals arrive. High-risk entities are surfaced without requiring analysts to manually hunt through logs.
• Anomaly types covered: Log360 tracks off-hours logons, access from new or high-risk geographies, unusual data transfers, abnormal authentication sequences, dormant account activity, and more.

Get plain language explanations for every anomaly

Flagging an anomaly without context creates more alert fatigue. Zia Insights automatically analyzes each detected anomaly and surfaces a structured explanation, what deviated, why it’s significant, and what to do next.

• Automatic log classification: Every incoming log is precategorized as error, security, audit, or crash before an analyst reviews it. Security-classified logs feed directly into anomaly analysis.
• Plain language summarization: Zia condenses each anomalous event into a concise summary that answers the critical questions: what happened, who was involved, when it occurred, and how it deviates from baseline.
• ATT&CK mapping: Each anomaly is automatically mapped to the relevant ATT&CK tactic, technique ID, and technique name. For example, an off-hours privileged logon maps to privilege escalation via valid accounts (T1078); a sudden spike in file access maps to collection (T1005).
• Impact and remediation guidance: Zia assesses the potential impact of each anomaly and delivers prioritized remediation steps aligned to the specific threat pattern not generic advice.

Correlate anomalies into attack chains automatically

Isolated anomalies become clearer and more urgent when you see how they connect. Log360's alert correlation agent reviews anomalous alerts within a chosen time window, identifies shared entities, and sequences them into a probable attack chain.

• Cross-entity correlation: The agent links anomalies that share a common user, IP, host, or domain, surfacing coordinated patterns that individual alerts obscure.
• Attack chain sequencing: Related findings are arranged chronologically with ATT&CK stage labels, reconstructing how an attacker moved through the environment. A single chain might progress from initial access through lateral movement to exfiltration.
• Confidence rating and remediation output: Each identified chain includes a confidence rating and actionable remediation steps so response decisions are risk-calibrated.
• Persistent pattern detection: Recurring anomaly patterns across alert types not just one-time spikes are surfaced and flagged for investigation.

Automate anomaly investigation from a single alert

When an anomaly warrants deeper investigation, the Alert Investigation Agent takes an analyst from alert fired to a complete attack picture automatically. A process that typically spans four to six tools and more than 30 minutes compresses to one click.

How the agent works

• Entity identification and data enrichment: The agent extracts all entities from the alert—users, IP addresses, domains, hosts, processes, and files. It then queries VirusTotal, Log360’s integrated advanced threat analytics, and UEBA to assess each entity’s risk level.
• Related alert and log analysis: The agent searches for other alerts linked to the same entities, finding recurring patterns or coordinated activity across alert types. When alert data alone isn’t enough, it queries log data using targeted searches to find additional events of interest.
• Timeline construction and suggestions: Related findings are arranged chronologically to show how the attack played out. The agent then presents suggested immediate actions and future risks of the identified threat.
• Investigation report: The agent creates a detailed report of the investigation trail that can be exported as a PDF and added to an existing or new incident as evidence.
• Human in the loop: At key decision points, the agent pauses for user input. Users can select from the given options and also manually enter queries in natural language to guide the investigation.