Hey All,
Just wanted to share a quick update on a powerful new capability with Nutanix Data Lens (SaaS): User Behavior Analytics (UBA) based Anomaly Detection.
Until now, Nutanix Files Storage anomaly detection primarily relied on static thresholds. While effective, thresholds can sometimes lead to noise, and require tuning, if certain users naturally perform high volumes of operations.
With UBA, Data Lens now intelligently establishes a baseline for each individual user's normal behavior across your shares.
Here are a few quick details on how it works:
- After configuring a deviation-based policy, it will use a 30-day warmup period to learn the baseline behavior for users based on their operation types (creates, reads, deletes, etc.) per share.
- Once the baseline is established, anomalies are triggered based on a meaningful deviation from that specific user's norm, rather than a hardcoded number. You can configure deviation percentage and minimum thresholds to tune sensitivity.
- You still have full control to exclude specific users or shares and set up monitoring schedules (e.g., weekdays only, specific business hours). For example, you can still rely on standard thresholds for non-business hours while using UBA during the workday.
This helps significantly reduce false positives while catching true anomalous behavior that deviates from a user's typical daily patterns.
For more details on configuring these policies, please refer to the updated Data Lens user guide. Let us know if you have any questions or feedback!