Access Anomaly Detector

How to use the Access Anomaly Detector

1. Prepare a CSV whose first row contains a user column (user or username), a file column (file, filename, or resource), and a timestamp column (timestamp, date, or time). Include one access event per row and use timestamps your browser can parse.
2. Drop the CSV into the upload area. The page confirms how many valid events it loaded. If the file is not ready, choose Load Sample to try the detector.
3. Set business-hours start and end using 24-hour values from 0 to 23. The start hour is included and the end hour is excluded; access times are evaluated in the browser's local time zone. Set the burst threshold to the number of event rows for one user within any five-minute window that should trigger a flag.
4. Choose Scan for Anomalies. Review each flagged user's name, file, timestamp, and reason. A flag is a prompt to investigate, not proof of misuse. Choose Export Flagged Events to download the findings as CSV.

Finding the handful of events that actually matter

A busy file-access log can have thousands of routine entries hiding the few that are genuinely worth a second look — someone touching dozens of files in minutes, or activity logged well outside normal working hours. Manually scanning for that is impractical past a few hundred rows; automated flagging against rules you set isn't.

Why burst detection uses a sliding time window

Counting "how many files did this user touch within any 5-minute window" (rather than just a daily total) catches rapid, concentrated activity — the pattern most associated with bulk downloads or scripted access — without false-flagging someone who steadily works through files over a normal day.