Manage Monitors and Observations

Requirements:

• Immuta permission AUDIT

• Monitors feature enabled

Create a monitor

1. Navigate to Detect in the navigation menu.

2. Click Create Monitor.

3. Enter a Name for the monitor.

4. Choose what to monitor in the dropdown menu:

   1. When User Accessed Any Data Source: This monitors user activity for all data sources in Immuta.

   2. When User Accessed Data Source in Schema: This monitors user activity for just the data sources within the schema you enter.

   3. When User Accessed Specific Data Source: This monitors user activity for the specific data source you enter.

5. Create conditions for the monitor to further scope user activities:

   1. Query Duration: This scopes the monitor to consider the duration of the query. Enter the Query Duration in seconds.

   2. Tag: This scopes the monitor to consider queries whose event contexts include all of the selected tags. The query must be associated with all specified tags in any combination of queried column tags, queried classification tags, and queried table tags. For more information, see the query event context concept.

   3. Query Outcome: This scopes the monitor to consider the queries' results as successful, unauthorized, or failure. You can select Unauthorized or Failed to create a monitor that can notify you when a registered Immuta user has exceeded the configurable threshold for unauthorized or failed queries. This condition only works with the User Query Count metric scoped to When User Accessed Any Data Source.

   4. Sensitivity: This scopes the monitors to only consider queries that are classified as sensitive or highly sensitive. This condition should only be used if classification has been configured.

   All conditions must be satisfied for the query to be considered by the monitor.

6. Select Next to configure rules.

7. Select the Timeframe from the dropdown menu to specify the time range the threshold cannot be exceeded within.

8. Choose what kind of user activity metric to monitor in the metric dropdown menu:

   1. Number of Rows Accessed: This monitors for the quantity of rows the user accessed and can be combined with additional conditions on tags and sensitivity. The exact number of rows is configured in the severity thresholds.

   2. User Query Count: This monitors the number of queries the user made and can be combined with additional conditions on tags, sensitivity, and query outcome. The exact number of queries is configured in the severity thresholds.

9. Select at least one of the Severity Thresholds to set thresholds for the configured user activity metric. An observation will be created and assigned the matching severity when the metric exceeds the threshold.

10. Click Next to show the notifications configuration.

11. Choose the frequency of the notifications to webhooks when an observation is created:

    1. Never: You can review observations in the Immuta application, and Immuta will not send webhook notifications when observations are made.

    2. Notify each time an Observation is generated: Every time the monitor creates an observation, a webhook notification will be sent.

    3. Notify the first time an Observation is generated for each user: Every time the monitor creates an observation, a webhook notification will be sent for the first observation about a user. You will not receive notifications for observations from the monitor again for previously notified observations about the same user. New observations about users that were previously notified can be reviewed in the Immuta UI.

12. Select a webhook from the dropdown menu or opt to create a new webhook.

13. Choose the severity you want notifications for. This will send out webhook notifications only for the severity threshold that you select.

14. Click Next and review the monitor selections.

15. Click Create Monitor.