What is Deep Analysis?
Deep Analysis is a final check before an event becomes an Active alert. It compares the event with your organization's past alerts of the same type and looks at whether similar activity led to a SAR filing.
Prerequisites
Deep Analysis made available to your organization by Kinectify.
How Deep Analysis works
Deep Analysis uses a model built from your enterprise's past alerts for each alert type, and from whether each of those alerts ended with a SAR filing. Because the model is built for your enterprise, it compares an event with past alerts from all of your properties, not only the property where the event happened.
When an event reaches Deep Analysis, the model estimates how closely the event resembles activity that led to a SAR filing. If it does, the alert is created. If it doesn't, no alert is created and the event goes to the Non-Escalated Events log instead.
If there's no Deep Analysis model yet for an alert type, events of that type become alerts as usual.
When Deep Analysis runs
Deep Analysis only checks events that would otherwise become alerts: events that aren't duplicates, that meet the alert type's Threshold score and, if pattern qualification is on, that meet your pattern qualification settings. If pattern qualification is off, Deep Analysis checks every event that meets the Threshold score.
What happens when you turn it on
With Deep Analysis on, an event that passes every other check becomes an alert only if Deep Analysis finds it resembles activity that led to a SAR filing, or if there's no Deep Analysis model yet for its alert type.
Kinectify sets Deep Analysis for your enterprise, and your properties follow that setting. For a property with custom settings, you can turn Deep Analysis on or off for that property in Settings > Alerts (Beta), as long as it's on for the enterprise.
Reviewing events Deep Analysis didn't escalate
Go to Logs > Non-Escalated Events and filter Outcome Type by Deep Analysis. Open an event and select the Governance tab to read Deep Analysis's explanation. The explanation describes the factors that most influenced the decision and may say how many of the most similar past alerts had the same outcome. It may describe past alerts as "closed", meaning they ended with a SAR filing, or "not closed".
The Similarity confidence figure is Deep Analysis's estimate, as a percentage, of how closely the event resembles activity that led to a SAR filing. It's usually low for events Deep Analysis didn't escalate.
If you believe the event still needs to be investigated, select Escalate event and enter a Justification. Kinectify creates an alert.
Related Articles
What is pattern qualification?
What is the alert threshold?
What happens to events below the escalation threshold?