> For the complete documentation index, see [llms.txt](https://wiki.datadike.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.datadike.com/en/administration/ueba/policy.md).

# Detection and mitigation policy

{% hint style="info" %}
Three controls on this screen — Request reauthentication, Automatic credential rotation and Revoke credentials automatically — are delivered in a forthcoming release. Every other setting described on this page is available today.
{% endhint %}

## What this is and when to use it

The behavior analytics module builds a baseline of how each user normally works — when they connect, from where, to which assets — and scores any departure from it. The policy is where you decide two separate things: **how sensitive the detection is**, and **what the solution does on its own** when a score crosses a line you set.

Configure it when you first roll out behavior analytics, and revisit it when the volume of anomalies is either too noisy to review or too quiet to be useful.

Detection and mitigation are independent. You can run detection alone — the solution records the anomaly and raises an alert, and a human decides what to do. Automatic mitigation is what lets it act without waiting for that human.

## Before you start

* The **SYSADMIN** profile. The policy is not visible to other profiles.
* At least one baseline window of session history. On a new installation the scores are unreliable until users have worked through a full window.
* If you plan to enable automatic credential rotation, at least one credential rotation task must already exist and be active. The policy is the trigger; the task is what actually rotates. See [Rotate credentials](/en/administration/accounts/rotation.md).

## Steps

1. Open **Policies › UEBA**.
2. Turn on **Detection enabled**. Nothing is scored while this is off.
3. Set **Baseline window (days)** to the period the solution should treat as normal behavior. Thirty days covers a monthly work cycle; shorter windows react faster but flag more false positives.
4. Set **Off-hours (start → end)** to the hours outside which access is unusual for your organization. The range wraps midnight, so `18 → 8` means six in the evening until eight the next morning.
5. Set **Failed login threshold** to the number of failed logins within twenty-four hours that should be treated as a burst.
6. Decide whether the solution should act on its own. If it should, turn on **Automatic mitigation**. Leave it off to run in alert-only mode.
7. With automatic mitigation on, set each action and its threshold:
   * **Kill-session score threshold** — the score at or above which a live session is terminated.
   * **Automatic credential rotation** and **Credential rotation threshold** — the score at or above which every secret defined in the rotation tasks is rotated.
   * **Revoke credentials automatically** — revokes credentials linked to the user or the session.
8. Click **Save**.

## What you should see

The counters at the top of the screen — **Open**, **High risk** and **Total** — reflect anomalies already recorded. They do not change when you save the policy; they change on the next analysis run.

![The UEBA policy screen with detection enabled and automatic mitigation off](/files/7pGXQALm42J8TdTXWIlH)

## How to verify it worked

Saving the policy is not proof that it is in force. Verify against a real anomaly:

1. Click **Analyze now** and wait for the run to finish.
2. Open **Audit › UEBA**.
3. Open any anomaly and read the **Mitigation** field.

The field states which action was applied and why. With automatic mitigation off it reads `Alert only — auto-mitigation disabled`. With it on, the field names the action the solution took, and a session terminated by the policy also appears as closed in **Sessions › Online**.

If the Mitigation field still shows the previous behavior, the policy did not save — reopen the screen and confirm the values persisted.

## Common errors

| Symptom                                                       | Cause                                                                          | Fix                                                       |
| ------------------------------------------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------- |
| No anomalies after **Analyze now**                            | Less history than the baseline window                                          | Wait for a full window, or shorten the window temporarily |
| Everything is flagged as an anomaly                           | Baseline built during an atypical period, such as a migration                  | Lengthen the baseline window and re-run the analysis      |
| Sessions are not terminated although the threshold is reached | **Automatic mitigation** is off; the individual action does nothing on its own | Turn on Automatic mitigation                              |
| A value is refused when you type it                           | The field is outside its accepted range                                        | See the range in the field reference below                |

## Field reference

| Field                            | What it does                                                                             | Accepted values | Default  |
| -------------------------------- | ---------------------------------------------------------------------------------------- | --------------- | -------- |
| Detection enabled                | Master switch for scoring. Nothing is analyzed while off                                 | On, Off         | On       |
| Automatic mitigation             | Master switch for every automatic action. While off the solution only records and alerts | On, Off         | Off      |
| Request reauthentication         | Challenges the user to authenticate again                                                | On, Off         | Off      |
| Automatic credential rotation    | Rotates every secret defined in the rotation tasks                                       | On, Off         | Off      |
| Revoke credentials automatically | Revokes credentials linked to the user or the session                                    | On, Off         | Off      |
| Baseline window (days)           | Period treated as normal behavior                                                        | 7 to 180        | 30       |
| Off-hours (start → end)        | Hour range treated as outside working hours. Wraps midnight                              | 0 to 23, each   | 18 → 8 |
| Failed login threshold           | Failed logins within 24 h that count as a burst                                          | 3 to 50         | 5        |
| Kill-session score threshold     | Score at or above which a session is terminated                                          | 50 to 100       | 80       |
| Credential rotation threshold    | Score at or above which credentials are rotated                                          | 50 to 100       | 90       |

## Related pages

* [Risk score](/en/administration/ueba/risk-score.md) — how the score is calculated and what each band means
* [Rotate credentials](/en/administration/accounts/rotation.md) — the task that performs the rotation
* [Audit trail](/en/administration/audit/audit-trail.md) — where mitigation actions are recorded
* [Live monitoring](/en/administration/sessions/live-monitoring.md) — terminating a session by hand