Identity Defense Current - User Guide

Introducing Quest Identity Defense Audit
Configuring Audit Working with Audit
Using the Audit Dashboard Searching for specific event data (Quick Search) Working with critical activity Working with searches Managing Reports Working with alerts and notification templates Auditing Microsoft Entra Auditing Microsoft 365
Findings Tier Zero Objects Shields Up Protection (Prevention) Privileged Objects Managing Workload Identities Assessments Hybrid Audit Agentic Defense Identity Defense Settings Appendix - Available Audit Search Columns and Filters Appendix - Identity Defense Indicator Details Appendix - Data Collection Details Appendix - FedRAMP Support Documentation Roadmap

Creating a Discovery

You can create custom Discoveries based on pre-defined vulnerability templates.

NOTE: All of the available vulnerability templates are used in pre-defined Discoveries. You can refer to the Pre-defined Discoveries and Vulnerabilities for Active Directory and Entra ID sections for guidance when creating a new Discovery.

To create a Discovery:

  1. From the Discoveries list, click Create.
  2. Select a Workload (Active Directory or Entra ID).
  3. Enter a Discovery Type.
  4. Click Select Vulnerabilities to display a list of available vulnerability templates for the workload.
  5. Select each vulnerability template you want to add to the Discovery, then click Select.
  6. For each vulnerability added to the Discovery:
    1. Enter a Vulnerability Name.
    2. For Risk, enter the reason why the vulnerability is considered a risk. For Remediation, enter the recommendation for resolving the vulnerability.

      TIP: You can refer to Pre-defined Discoveries and Vulnerabilities for Active Directory and Entra ID for examples of Risk and Remediation text.

  7. If the vulnerability includes a Scope, specify the objects that you want the Assessment to evaluate. Use the information in the following table for guidance.

    NOTES:

    • If the Tier Zero or Privileged objects checkbox is selected, all applicable Tier Zero or Privileged objects, both those collected from the provider (Identity Defense or BloodHound Enterprise) and any that were manually-created, will be included in/excluded from the scope (depending on which option you select).
    • If a vulnerability pertains to a specific object or set of objects, the Scope section will be hidden. For example, if the vulnerability pertains to users, only Tier Zero users will be included. If the vulnerability pertains to a specific AD group, such as Built-In administrators, only that group will be included.
    Scope selection Description
    All {objects} All objects in the workload that are the applicable object type, including both Tier Zero/Privileged and non-Tier Zero/Non-Privileged objects.
    Select {objects} Only the objects you specify based on your selection criteria will be included. When finished, click Add Object to add the object (s) to the Selected {Object}s list. If you want to exclude individual objects within your selection (for example, you selected an AD group but want to exclude individual members from the scope), click Add Exceptions and enter the object(s) as you would if you were adding objects.
    All Except Selected {objects} Only the objects you specify based on your selection criteria will be excluded from the scope. You can add multiple objects, separated by semicolons. When finished, click Add Object to add the object (s)to the Selected {Object}s list.
  8. Click Save.

Viewing, Editing, and Deleting a Discovery

From the Discoveries list, you can view the details of a Discovery. You can also edit or delete a user-created Discovery. You can also change the scope of a pre-defined Discovery (if applicable) and, in a few cases, the What to find value. (Refer to the Pre-defined Discoveries and Vulnerabilities for Active Directory and Entra ID sections for specific Vulnerability templates.)

 

NOTE: You cannot delete pre-defined Discoveries and the option will be disabled.

To view a Discovery:

  • Click the Discovery Type link.

To edit a Discovery:

  1. Either:

    • In the Discoveries list, select the Discovery that you want to edit.

      OR

    • Open the Discovery that you want to edit.

  2. Click Edit.

  3. Update the Discovery as needed.

  4. Click Save.

To delete a user-created Discovery:

NOTE: Currently, you can only delete one Discovery at a time.

  1. Either:

    • In the Discoveries list, select the Discovery that you want to delete.

      OR

    • Open the Discovery that you want to delete.

  2. Click Delete.

You will be prompted to confirm the deletion.

Hybrid Audit

Hybrid Audit in Quest Security Management Platform allows you to monitor and analyze activity across both your on-premises and cloud-based Microsoft environments from a single, unified interface. To accomplish this, Hybrid Audit agents are installed in your Active Directory domain to monitor and record activity. You can then search and view the recorded events through Audit.

Hybrid Audit requires the following components:

  • A deployed Hybrid agent that has been configured as a broker that connects with your on-premises Active Directory domains. See Working with Hybrid Audit Brokers for more details.
  • Installed Hybrid Audit agent on Domain Controllers and member servers in the appropriate Active Directory domain to record events for actions performed on those computers. See Hybrid Audit Agent Deployment for details on installing an agent.
  • Enabled events within Identity Defense so they can then be searched and viewed with Security Management Platform's Audit functionality. Refer to Working with Audited Events for more details.

For more details on installing and using a Hybrid Audit agent with Identity Defense, see:

Overview of the Hybrid Audit Workflow

To set up Hybrid Audit for Active Directory in your organization, follow these steps:

  • Step 1: Add Hybrid Agent
    • Go to Tenants | Hybrid Agents and add a hybrid agent.
  • Step 2: Install Hybrid Agent
    • Install the hybrid agent in the Active Directory forest to be audited.
  • Step 3: Configure Hybrid Agent
    • Navigate to Tenants | Hybrid Agents and click Edit configuration on the newly installed agent.
    • Under Actions, click Select Actions and add Manage Identity Defense Hybrid Audit.
    • Click Save.
  • Step 4: Verify Broker Connection
    • Navigate to Defend |Configuration | Hybrid Audit | Brokers.
    • Wait a few minutes for the Hybrid Audit Broker to display and confirm it is connected.
  • Step 5: Wait for Topology Discovery
    • Navigate to Defend | Configuration | Hybrid Audit | Agent Deployment.
    • Wait for the topology to auto-complete and populate the list of non-workstation computers.
  • Step 6: Install Hybrid Audit Agents
    • In Defend | Configuration | Hybrid Audit | Agent Deployment, deploy Hybrid Audit agents to all Domain Controllers and Global Catalog Servers to audit:
      • Active Directory
      • Group Policy events
      • Logon Activity events
    • Deploy Hybrid Audit agents to other computers to audit Logon Activity as needed.

NOTE: Logon Activity Authentication Activity events require native Windows "Audit Logon events" audit policy enabled on servers. See following guide for details: Change Auditor for Logon Activity Events.

  • Step 7: Review Audited Events
    • Navigate to Defend | Configuration | Hybrid Audit | Audited Events.
    • Review the list of events audited in the Active Directory forest.
  • Step 8: View Audited Event Details
    • Navigate to Defend | Detect | Audit.
    • From the Searches tab, search events using predefined Active Directory, Group Policy, and Logon Activity searches.
    • Use the Hybrid Audit Event Name in the Change Auditor Event Class Name filter to create custom searches to search specific events.

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating