I am looking for a supported way to query and automate the information displayed under Users and Accounts > User Risk Ranking.
The built-in page ranks users by their number of notable behaviors. I would like to use the same data for:
A dashboard showing each user and the number of notable behaviors in the last 30 days
Historical comparison and trend reporting
Scheduled PDF or CSV reports sent by email
An alert when a new user enters the table or newly appears in the top 10
An alert when a user’s behavior count increases significantly
The purpose would be low-severity early warning. A notable-behavior ranking change would not by itself be treated as an incident, but it could identify weak signals associated with a compromised account, hidden malware, or command-and-control activity before a higher-confidence alert is generated.
Has anyone implemented this?
Specifically:
Can the underlying notable behaviors be searched with LEQL?
Which log set and fields contain this data?
Is the User Risk Ranking available through an API?
Can its data be added to a custom dashboard or scheduled report?
Can InsightIDR alert when a user enters the top 10, or does this require an external process that stores and compares ranking snapshots?
What approach are other customers using for this kind of suspicious-user early warning?
I would prefer to consume InsightIDR’s existing analytics rather than rebuild the behavior logic from raw events.
Thanks for any examples or recommendations.
Thomas
Hi Im Zack and I happen to be a Sales Engineer here at Rapid7 and I noticed this post and wanted to help where I could.
The Risky Users feature and the Notable Behaviors are great to lean into to understand who is doing what, but the unfortunate short answer here is that neither are exposed in the API and aren’t in search queries. Notable Events themselves aren’t in any sort of log set itself, rather just an attribution of particular detections. In other words every detection either goes to an alert, investigation, notable behavior. So in theory you could find the detections that make up the Notable behaviors side of things and do something there possibly.
On the API side, I went and checked what's actually available right now and it's Accounts & Users, Alerts (MDR only), Assets, Investigations, Detection Rules, Audit, and Log Search. None of those expose a risk score or ranking directly. The closest things are the Investigations API and the Alerts API, both of which let you pull records tied to a specific user/actor, but that's not the same math the Risky Users page runs.
Some things you might be able to do is use the investigations API or Alerts API to pull a daily (or some cadence) of what is there, and do some grouping or calculations based on what users are involved. Stash that info somewhere and each time you run the API query run a diff. You’d likely be able to build something like this using InsightConnect.
As a side conversation, are you more interested in Risky being defined by action, or by attribution? I’ve helped folks do something similar for Risk ratings based on things like, are they admin, do they have MFA, what do they have access to, for assets they may be be able to touch, do those assets have critical vulns, do they have endpoint protection, etc. That is something we can aggregate fairly easily if you have Surface Command, Exposure Command, or anything with our ASM.