Daily review and periodic access review

What this page covers

Once the evidence is there, someone has to look at it regularly. This page covers four kinds of follow-up work: the daily sign-off on security events, dispositions on alerts, the periodic access review, and the alert that watches for new source addresses. It ends with the self-service page for ordinary users, because that is another projection of the same records.

Daily security event review

The policy key “Daily review sign-off” ships off. If an in-force policy group requires it on, the drawer shows that requirement. Sign-off happens on the Daily Review tab of the Operation logs page, and covers one completed day in the business time zone, from 00:00 to the next 00:00. The policy key “Daily review business time zone” sets that zone, and a change takes effect from the next date. A day can be signed from 30 minutes after it ends, so that records written around midnight are in place first. Each reviewed day has at most one sign-off.

The top of the tab shows the sign-off rate and the on-time, late, and unsigned days for the last 30 days, the last 90 days, or a custom range. Below that come the days awaiting sign-off, from the earliest, and then the sign-off records, from the newest, which can be limited to late ones.

Signing happens in a drawer. It lists the day’s unreviewed alerts and the earliest 20 failed logins and high-risk operations, with a link to the Operation logs for that day, and shows a reason for each record, such as what a retention purge cleared. A day can be signed once all of its alerts are reviewed, and the alerts can be reviewed in the drawer, one at a time or several together. The note is optional.

Missed days can be signed later, with no time limit. A sign-off before the end of the day after the reviewed day is on time; after that it is late, and the record marks the number of days late and requires a delay reason. The server records the time of signing, kept apart from the reviewed day. While any day is past its on-time deadline, a reminder goes out over the notification channels once a day after 09:00 in the business time zone, listing the unsigned days, and it stops once all are signed.

How the counts are defined: failed logins cover both failure and refusal states of authentication events, leaving out routine credential expiry, which still stays in the records one by one. High-risk operations are a list: deletion of any resource; creating, updating, and deleting security policy, syslog settings, and audit exports, plus downloading an audit export; and the creation and updating of accounts. Reading those settings and previews are not counted. Retention purges, role or group mappings recalculated at sign-in without any change, and the second record that some operations write are not counted either; these records stay in the Operation logs.

The “Daily Security Review” card on the dashboard shows yesterday’s counts and the unsigned days, or the signer and the 30-day sign-off rate once all days are signed. Its buttons and dates open that day’s sign-off drawer. People who can sign see the number of days awaiting sign-off on the Operation logs item in the sidebar and on the tab, in red once one is overdue. The dashboard of a non-auditor role does not show this card.

Alert dispositions

On the alert records tab of the Alerts page, the list can show only the unreviewed ones. Press Review, choose a disposition (false positive or harmless, or escalate), and add an explanation if you want. A disposition can be redone, which is how a misjudgment gets corrected. The reviewer, time, classification, and note all stay on that alert.

Up to 50 alerts can be reviewed in a batch with one shared reason and individual results. Requery after a partial result. A reviewer’s own alerts are excluded. Pending break-glass reviews also support batch confirmation, while violations are decided individually.

Periodic access review

The Access Reviews page is open to the administrator and auditor roles, and signing off is for administrators. The page shows how long it has been since the last review, how many days the suggested cycle is, and whether it is overdue, with the cycle value supplied by the server.

Pressing “Start an access review” explains that the action snapshots the complete access matrix as it stands as immutable evidence, and records a sign-off with the reviewer, time, and conclusion. The conclusion field holds the outcome of this review, for example that everything was examined and nothing was out of order, or a list of adjustments.

The history lists every review with its reviewer, time, number of authorizations, and conclusion, and “View snapshot” shows the authorization matrix as it was: authorization identifier, subject, object, and scope. When a snapshot is damaged the system returns a clear error rather than handing over empty content that looks fine.

New source address alerts

The first time an account opens a protocol connection from a given address, the system produces a medium-severity alert. The baseline is the account and address pair, so connecting again from the same address does not alert again. The baseline transition and the alert are written in one transaction, and the notification is sent after the transaction commits.

Alerts of this kind hang on no rule, so disabling a rule does not make them disappear. The address on the alert row is a link that opens the investigation workbench pivoted on that address, with the time window set to the day of the alert and every category selected.

A web login from a new address is handled differently: it leaves an audit record and enters the baseline, without producing an alert or a push. This baseline falls outside the purge scope of every retention policy.

My connections

Ordinary users have a self-service “My connections” page showing what they connected to: asset name, protocol, connection time, duration, and status. A connection in progress can be terminated by the user, with a second confirmation, and the record notes that the user ended it themselves.

The page is a narrow projection built from a list of allowed fields, without commands, recordings, credentials, source addresses, or target host addresses, and with no entrance to command views or playback. Termination recognizes the owner alone, and someone else’s connection reads as not found.

What auditors can see

• A daily review sign-off leaves a record with the reviewed day, the time of signing, the time zone, the count snapshot, and the note; a late sign-off also keeps the days late and the delay reason.
• Evidence packages include daily_reviews.csv, with one row for every day in the window on which daily review was enabled, unsigned days and days not yet due included.
• An alert disposition leaves a record with its classification.
• An access review sign-off leaves a record, and the snapshot itself is immutable.
• A new source address alert is bound to that session, user, and asset, and the address is carried by the session it belongs to.
• A user terminating their own connection leaves a record with themselves as the operator.