Hybrid Audit uses the hybrid agent to communicate with on-premises Active Directory domains. A Hybrid Audit Broker is a Hybrid Audit agent that has been assigned the Manage Security Guardian Hybrid Audit permission.
The Hybrid Audit Broker:
-
Scans your Active Directory forest topology to identify where Hybrid Audit agents can be deployed.
-
Acts as a communication hub, sending commands to the agent and forwarding collected audit events to be displayed in Security Guardian.
|
|
IMPORTANT:Each Active Directory forest where hybrid audit agents are deployed must have at least one hybrid audit broker installed. |
For more information, see:
The Audited Events page shows all events that are currently being monitored, as well as those that can be monitored by the Hybrid Audit agent.
|
|
NOTE:
-
Events that are disabled by default are typically noisy events that should only be enabled for specific investigations.
-
Active Directory, Group Policy, and Logon Activity events recorded by the deployed Hybrid Audit agents are available to search in Audit | Search. Specific events can be searched by using the Hybrid Audit Event Name in the Change Auditor Event Class Name search filter. |
To view event details:
-
Click an event link to open a window with additional information, including the event’s Name, Description, Subsystem, and current Status.
To enable and disable the events:
To filter the display:
The Protection page in Security Guardian displays a list of templates used to protect Active Directory and Group Policy objects. Each domain within a forest has its own unique set of protection templates. For example, if a forest contains two domains, two separate sets of Tier Zero protection templates—one for each domain is displayed.
For information on enabling protection, see Protecting Tier Zero Objects.
|
|
NOTE: Protection templates are only created and applied to domains that meet both of the following conditions:
|
Administrators can edit existing templates to remove Active Directory objects and group policies from protection and manage override accounts.
|
|
NOTE:
-
You cannot add new protected objects during edit.
-
Template name and type remain fixed.
-
Predefined override accounts are permanent and cannot be removed. |
To view the enabled protection templates:
Table 2: Available Protection Information
| Column |
Description |
| Template Name |
The name assigned to the protection template. |
| Domain |
The domain associated with the template. |
| Type |
Indicates whether the template applies to Active Directory or Group Policy. |
| Protected Object |
The specific object being protected by the template. |
To filter the display:
To view template details:
-
In the Protection table, locate the template you want to view.
-
Click the template name link.
A flyout opens and displays the name of the selected protection template, the name of the account that overrides protection, and whether the override applies to Active Directory or Group Policy.
To edit protection:
-
In the Protection table, locate the template you want to view.
-
Select a single Active Directory or Group Policy template.
-
Click Edit.
-
Select the required objects, click Remove, and click Save and Continue to optionally edit the override accounts.
-
Add or remove override accounts as required.
-
Click Save and Finish to apply the updates.
From the Security Guardian Settings page you can:
