RSA Advisor for Admin Threats

The RSA Advisor for Admin Threats conducts a comprehensive analysis of administrative activity within an ID Plus tenant through administrator logs that are stored within the Sentinel Datalake. This agent is designed to identify and surface potentially suspicious activity that could indicate the compromise of an administrator account and/or a potential insider threat. Utilizing this advisor, security administrators and analysts can save time, as it automates the process of searching through logs and correlating events using natural language prompts, resulting in quicker and more accurate conclusions.