Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

FREE TRIALS

Security Guardian Current - User Guide

Table of Contents

Introducing Quest Security Guardian

About On Demand About Security Guardian Security Guardian Intelligence Access Control Functional Overview Configuring Additional Components

Using the Dashboard Security Guardian Inteligence

Using Security Guardian Intelligence and Findings Using Security Guardian Intelligence and Assessments

Tier Zero Objects

How Tier Zero Objects are Identified Tier Zero Objects List Viewing Tier Zero Object Details Adding Tier Zero Objects Manually

Removing Manually-Added Tier Zero Objects

Certifying Tier Zero Objects Protecting Tier Zero Objects Exporting the Tier Zero Objects List

Shields Up Protection

Using Shields Up Enabling Shields Up Disabling Shields Up Override Access for Protected Objects

Privileged Objects

Privileged Objects List Viewing Privileged Object Details Adding Privileged Objects Manually

Removing a Manually-added Privileged Object

Certifying Privileged Objects Exporting the Privileged Objects List

First Assessment Notification Email Built-in Assessments All Assessments List Creating an Assessment Viewing, Editing, and Deleting an Assessment Viewing Assessment Summary Information Assessment Results

Viewing Details for an Assessed Vulnerability

Discoveries and Vulnerabilities

Discoveries List Pre-Defined Active Directory Discoveries

Additional Permissions Required for Specific Vulnerabilities Discovery for Credential Access Vulnerabilities Discovery for Defense Evasion Vulnerabilities Discovery for Discovery Vulnerabilities Discovery for Initial Access Vulnerabilities Discovery for Lateral Movement Vulnerabilities Discovery for Persistence Vulnerabilities Discovery for Privilege Escalation Vulnerabilities Discovery for Reconnaissance Vulnerabilities

Pre-Defined Entra ID Discoveries

Entra ID Vulnerabilities that Require a Premium License Discovery for Entra ID Credential Access Vulnerabilities Discovery for Entra ID Discovery Vulnerabilities Discovery for Entra ID Initial Access Vulnerabilities Discovery for Entra ID Persistence Vulnerabilities Discovery for Entra ID Privilege Escalation Vulnerabilities

Creating a Discovery Viewing, Editing, and Deleting a Discovery

Managing Workload Identities

Viewing Workload Identity Details Setting Workload Identity Category Setting Privileged Status for Workload Identities Certifying Privileged Status Reloading Workload Identities

Investigating Findings

Investigating Tier Zero and Privileged Object Findings Investigating Hygiene and Detected Indicators

Muting Findings for Hygiene and Detected Indicators Dismissing Findings Viewing Finding History

Security Settings

Configuring a Forwarding Destination Managing Indicators

Muting and Unmuting Indicators

Managing Data Collections

Appendix - Security Guardian Indicator Details

Indicators by Severity Indicators by Source

Indicators from On Demand Audit Indicators from Security Guardian Assessments Indicators from Security Guardian and Protection for Tier Zero Objects

Appendix - Data Collection Details

Active Directory Data Collection Details Microsoft Entra ID Data Collection Details

Microsoft Entra ID Data Collection Details

Object	Attribute/Object
Application	AppId CreatedDateTime DeletedDateTime DisplayName Id IdentifierUris KeyCredentials Owners PasswordCredentials VerifiedPublisher
Authorization Policy	AllowedToUseSSPR DefaultUserRolePermissions DisplayName Id
Conditional Access Policy	ApplicationsIncludeApplications ConditionalAccessPolicyIncludeUser ConditionalAccessPolicyExcludeUser ConditionalAccessPolicyIncludeGroup ConditionalAccessPolicyExcludeGroup ConditionalAccessPolicyIncludeRole ConditionalAccessPolicyExcludeRole ConditionsClientAppTypes ConditionsSignInRiskLevels ConditionsUserRiskLevels CreatedDateTime DisplayName GrantControlsBuiltInControls GrantControlsOperator Id ModifiedDateTime SessionControlsContinuousAccessEvaluation SessionControlsSecureSignInSessionIsEnabled SessionControlsSignInFrequencyAuthenticationType SessionControlsSignInFrequencyFrequencyInterval SessionControlsSignInFrequencyIsEnabled State TemplateId
Contact	DisplayName GivenName Id JobTitle Mail OnPremisesLastSyncDateTime OnPremisesSyncEnabled Surname
Device	AccountEnabled ApproximateLastSignInDateTime ComplianceExpirationDateTime CreatedDateTime DeletedDateTime DeviceCategory DeviceId DisplayName DomainName Id IsCompliant OnPremisesLastSyncDateTime OnPremisesSecurityIdentifier OnPremisesSyncEnabled OperatingSystem OperatingSystemVersion RegistrationDateTime TrustType
Directory Role	Description DirectoryRoleMember DisplayName Id IsBuiltIn IsEnabled IsPrivileged Members RoleTemplateId
Group	CreatedDateTime DeletedDateTime Description DisplayName ExpirationDateTime Members Owners GroupTypes Id Mail MailEnabled OnPremisesDomainName OnPremisesLastSyncDateTime OnPremisesNetBiosName OnPremisesSamAccountName OnPremisesSecurityIdentifier OnPremisesSyncEnabled PreferredLanguage RenewedDateTime SecurityIdentifier Visibility
MS Authenticator Policy	ExcludeTarget FeatureSettings Id IncludeTarget State
Organization	BusinessPhones City Country CountryLetterCode CreatedDateTime DefaultUsageLocation DeletedDateTime DisplayName Id IsMultipleDataLocationsForServicesEnabled OnPremisesLastPasswordSyncDateTime OnPremisesLastSyncDateTime OnPremisesSyncEnabled PostalCode PreferredLanguage State Street TechnicalNotificationMails TenantType
Security Defaults Policy	Description DisplayName Id IsEnabled
Service Principal	AccountEnabled AlternativeNames AppDescription AppDisplayName AppId ApplicationAuthenticationClientSignInActivity ApplicationAuthenticationResourceSignInActivity ApplicationTemplateId AppOwnerOrganizationId AppRoleAssignmentRequired CreatedDateTime DelegatedClientSignInActivity DelegatedResourceSignInActivity DeletedDateTime Description DisabledByMicrosoftStatus DisplayName Id KeyCredentials LastSignInActivity Owners PasswordCredentials ServicePrincipalType SignInAudience Tags
Service Principal Permissions	ConsentType PermissionDisplayName(AppRole displayName) PermissionType PermissionValue(AppRole value) ResourceDisplayName ServicePrincipalId
User	AccountEnabled BusinessPhones DisplayName ExternalUserState GivenName Id JobTitle LastPasswordChangeDateTime LastSignInDateTime Mail OnPremisesDomainName OnPremisesLastSyncDateTime OnPremisesSamAccountName OnPremisesSecurityIdentifier OnPremisesSyncEnabled SecurityIdentifier SignInActivity Surname UserPrincipalName UserType
User Registration Details	Id IsAdmin IsMFARegistered MethodsRegistered UserDisplayName UserPrincipalName UserType

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating