Functional Overview for Active Directory
.
Functional Overview for Entra ID
Functional Overview for Active Directory
.
Functional Overview for Entra ID
Additional components need to be configured to make Security Guardian fully functional.
To configure additional components:
From the On Demand left navigation menu, choose Security | Dashboard.
From the Configuration Status tile, configure the necessary components.
|
NOTE: Once an additional component is configured in On Demand, it's available to any other module that uses it. |
Component | Purpose | Instructions | ||
---|---|---|---|---|
Hybrid Agent | Gives Security Guardian access to the Active Directory domain(s) that you want to keep secure. |
On Demand Global Settings User Guide - Managing your on-premises domains When configuring the agent, ensure that:
| ||
Entra ID Data Collector | A Service Principal that gives Security Guardian access to Entra ID objects in the tenant(s) that you want to keep secure. |
On Demand Global Settings: When configuring the tenant, ensure that Core | Collectors consent is granted to each tenant for which you want Entra ID object data to be collected.
| ||
Quest Change Auditor (via On Demand Audit) |
Sends Active Directory events to On Demand Audit for reporting in Security Guardian Findings and allows you to protect Tier Zero objects.
|
Instructions are provided via a tool tip in the Security Guardian UI. You can also find instructions at On Demand Audit User Guide - Change Auditor Integration
| ||
SpecterOps BloodHound Enterprise (Optional) |
Identifies Tier Zero assets in your organization's Active Directory domain(s) and Privileged assets in your Entra ID tenant(s), which you can monitor and assess for security vulnerabilities in Security Guardian.
|
On Demand Audit User Guide - SpecterOps BloodHound Integration | ||
SIEM solution:
(Optional) |
Allows Security Guardian Findings to be forwarded to a configured SIEM tool for further analysis
|
The Security Guardian dashboard displays a visual summary of the current security status of your organization's Active Directory and Entra ID.
To access the Security Guardian dashboard:
From the On Demand left navigation menu, choose Security | Dashboard. The dashboard contains tiles for each of the following components:
The Uncertified Tier Zero Objects and Uncertified Privileged Objects tiles:
display the last time the objects list was synchronized
list the last ten uncertified objects of each type that were added to Security Guardian (you can click View All for an object type to view the complete list for each workload)
|
NOTE: Objects that have been certified are excluded from the lists. |
provide links that allow you to
|
NOTE: From within the Details view you can also certify the Tier Zero or Privileged object. Once an object is certified, it will no longer display in this tile. |
|
NOTE: If Security Guardian is your provider, this link is hidden. |
The Highest Severity Findings tile displays the top five active findings of the highest severity. Information includes:
The View All link at the bottom of the tile allows you to view the list of all active Findings for the organization.
The Active Directory Tier Zero Objects and Entra ID Privileged Objects tiles display graphical representations of the number of certified vs. uncertified objects.
The Active Hygiene and Active Detected tile shows the total number of Hygiene and Detected (TTP and Anomaly) Findings in the organization by severity level (Critical, High, and Medium).
From the Configuration Status tile you can configure additional components and view existing configurations.
Tier Zero objects are the most critical assets within an organization's Active Directory. Within the Microsoft enterprise access model, Tier Zero objects in Active Directory include accounts, groups, and other assets that have direct or indirect administrative control of AD and the assets within it.
Currently, Security Guardian supports the following Tier Zero object types:
The Tier Zero provider (Security Guardian or BloodHound Enterprise) identifies Tier Zero objects within the organization's Active Directory domain(s). These objects are then collected by and displayed in Security Guardian.
You can also add Tier Zero objects to Security Guardian manually.
© 2025 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center