Understanding 'Unusual' License Flags in Anomaly Detection

Overview

The anomaly detection mechanism identifies and flags licenses as "Unusual" when they deviate from the standard licensing practices within an organization. This ensures compliance and consistency in license usage.

How Anomalies Are Detected

Volume Licensing vs. Individual Licenses

Most organizations use volume licensing, where a single license is assigned to multiple devices. If an individual license is detected on a device instead of the expected volume license, the system categorizes it as an anomaly, marking the device as unusual.

OEM-Licensed Devices

Devices with OEM licenses, issued by the manufacturer, have unique licenses that are not shared across multiple systems. Since OEM licenses differ from standard volume licensing, they may also be flagged as anomalies.

Recommended Actions

• If OEM licenses are commonly used in your environment, consider whitelisting the PA rule to prevent these devices from being incorrectly classified as unusual.
  
• Regularly review flagged licenses to ensure compliance while avoiding unnecessary alerts.

For further assistance, refer to your licensing policy or contact support.