IT Security Search 11.3.2 - User Guide

Active Roles Data Fields

The following are lists of fields that occur in Active Roles data, organized by type of returned object. All of these fields are available in the IT Security Search web UI as clickable elements. You can also type any of these fields in your search queries.

Recovery Manager for Active Directory Data Fields

The following are lists of fields that occur in Recovery Manager for Active Directory data, organized by type of returned object.

Computers

Groups

OUs

Users

Saving Searches and Running Saved Searches

You can save any search for later reuse. Any IT Security Search operator or administrator can save searches and run saved searches, but only administrators can make them public for shared use.

Saving Searches

To save a search, click the drop-down icon at the left edge of the search box and click Save Current Search. Proceed to configure your search in the popup that appears:

• Give the search a meaningful name.
• Add tags so that users can easily find the search by category.
• Select which parameters you want to make customizable, if necessary.
  All field names that occur in your search string are listed. Select the check boxes next to the ones that you want to make customizable. Whenever this saved search is used in the future, it will prompt for the values of all of the fields you select.

• Specify the time period that the search must cover.
  For that, select one of the options at the right edge of the search box. These times are relative to the moment the saved search is run.

When you have configured these options, click Save.

Running a Saved Search

To run an existing saved search, click the drop-down icon at the left edge of the search box; the available saved searches are listed at the bottom of the popup that appears. You can filter the list by clicking tag buttons in the Saved Search Categories drop-down.

Making a Saved Search Public or Private

You can publish a search to make it available to all operators only if you are an IT Security Search administrator.

In the saved search list, the items have a lock icon showing their state. A private search has a closed lock icon; click the icon to make it public. A public search has an open lock icon; click the icon to make it private.

Deleting a Saved Search

To delete a saved search, highlight it in the saved search list and click the cross icon.

Use Scenarios

The following examples explain how IT Security Search tools can be applied in practice to real-life situations.

Finding and Examining a User

To find events where a particular user is somehow involved (as the doer or as a subject), run a search for any of the variety of names that identify the user in the environment. You can supply the first name, last name, full name, logon name and so on.

The results of your search put the most relevant matching users at the top of the list. If there are too many matches, refine the results using facets.

From a different perspective, if you need to find a user whose name you are not sure about but whose manager's name you remember, try searching for the manager's name, then opening the details of the manager's user account and finding the user you are looking for among the manager's direct reports.

Understanding Who Did What

A typical use case is tracking the activity that involved a particular object, such as a file, folder, group or user account. You begin by finding this object; this provides a starting point and a context for your session. The next step is to use the links in the object's details view. This is the easiest way to create a context and filter out irrelevant data.

Another option is to start with events directly, especially if you expect to find specific events within a specific period of time. To specify the period, use the date range filter. The graphical timeline in the result grid can help you quickly locate peaks of activity that need closer examination.

Exploring a User's Scope of Access

IT Security Search provides quick access to information about files and folders owned by a user and all permissions assigned to the user; for that, use the Files and folders owned by this user, Files and folders where this user has direct permissions and Files and folders where this user has permissions (both direct and indirect) links in the details view for the user you are interested in.

Conversely, if you start with a particular file or folder, its details contain a table of permissions, which can prompt your further steps.

Tracking Permission Management

You can easily follow permission assignment activity using the Who changed permissions on this file and Who changed permissions on this folder links in the details view of a file or folder, respectively.

Exploring Change History of Active Directory Objects

Object change history is available only if the Recovery Manager for Active Directory connector is enabled. For information about changes to an object, go to the History tab on the object's details page. Only the three most recent states are shown on this tab, with changes that occurred after each of them.

You can restore the object to any of these states by clicking its Restore object to this state link. If the object was changed rather than deleted, you have the option to restore specific modified attributes. If it was deleted, you can only restore it to a full state.

Case Studies

See also the following topics for examples of investigations that IT Security Search can help carry out:

• Case Study: Investigating Tampering
• Case Study: Making the Most of Multiple Connectors
• Case Study: Active Roles Dynamic Group Membership Tracking