立即与支持人员聊天

获得即时帮助
完成注册

登录

请求定价

联系销售人员

免费试用版

Security Guardian Current - User Guide

Introducing Quest Security Guardian

About On Demand

Accessing Quest On Demand Supported regions Access Control

About Security Guardian

Functional Overview Configuring Additional Components

Using the Dashboard

Configuring Audit

Working with tenants Granting required consent Configuring tenant auditing Historical event collection Change Auditor Integration

Customer data storage Registering a Change Auditor Installation Pausing Change Auditor event forwarding Resuming Change Auditor event forwarding Removing a Change Auditor Installation Reviewing the status of your Change Auditor installation

SpecterOps BloodHound Enterprise Integration

Configure a SpecterOps BloodHound Integration

Working with Audit

Using the Audit Dashboard

Working with Activity Indicators Monitoring Audit Health status Identifying critical activity Identifying the top active users Working with My Favorite Searches Monitoring sign-in trends

Searching for specific event data (Quick Search) Working with critical activity Working with searches

Working with private and shared searches Running a search Using built in searches

Active Directory Built in searches Active Directory Federation Services built in searches Active Directory Database built in searches Anomaly Activity built in searches Audit Health built in searches Microsoft Entra built in searches Best Practices built in searches BloodHound Tier Zero assets built in searches File System built in searches Group Policy built in searches Logon Activity built in searches Microsoft 365 built in searches On Demand Audit built in searches Teams built in searches Security Guardian built in searches

Filtering Searches Creating a custom search Copying an existing search Exporting a search Creating a search from an existing search Customizing the search display Viewing search results and event details Copying event details Modifying a search Deleting a search Working with categories

Working with alerts and notification templates

Using built in alerts and notification templates

Auditing Microsoft Entra

Event collection and Microsoft Entra subscription Working with Microsoft Entra Searches Working with Microsoft Entra events with multiple targets Auditing risk events

Auditing Microsoft 365

Investigating Findings

Investigating Tier Zero and Privileged Object Findings Investigating Hygiene and Detected Indicators

Using Security Guardian Intelligence with Findings Muting Findings for Hygiene and Detected Indicators Dismissing Findings Viewing Finding History

Tier Zero Objects

How Tier Zero Objects are Identified Tier Zero Objects List Viewing Tier Zero Object Details Adding Tier Zero Objects Manually

Removing Manually-Added Tier Zero Objects

Certifying Tier Zero Objects Protecting Tier Zero Objects Exporting the Tier Zero Objects List

Shields Up Protection (Prevention)

Using Shields Up Enabling Shields Up Disabling Shields Up Override Access for Protected Objects

Privileged Objects

Privileged Objects List Viewing Privileged Object Details Adding Privileged Objects Manually

Removing a Manually-added Privileged Object

Certifying Privileged Objects Exporting the Privileged Objects List

Managing Workload Identities

Viewing Workload Identity Details Setting Workload Identity Category Reloading Workload Identities

First Assessment Notification Email Built-in Assessments Using Security Guardian Intelligence with Assessments All Assessments List Creating an Assessment Viewing, Editing, and Deleting an Assessment Viewing Assessment Summary Information Assessment Results

Viewing Details for an Assessed Vulnerability

Discoveries and Vulnerabilities

Discoveries List Pre-Defined Active Directory Discoveries

Additional Permissions Required for Specific Vulnerabilities Discovery for Credential Access Vulnerabilities Discovery for Defense Evasion Vulnerabilities Discovery for Discovery Vulnerabilities Discovery for Initial Access Vulnerabilities Discovery for Lateral Movement Vulnerabilities Discovery for Persistence Vulnerabilities Discovery for Privilege Escalation Vulnerabilities Discovery for Reconnaissance Vulnerabilities

Pre-Defined Entra ID Discoveries

Entra ID Vulnerabilities that Require a Premium License Discovery for Entra ID Credential Access Vulnerabilities Discovery for Entra ID Discovery Vulnerabilities Discovery for Entra ID Initial Access Vulnerabilities Discovery for Entra ID Persistence Vulnerabilities Discovery for Entra ID Privilege Escalation Vulnerabilities

Creating a Discovery Viewing, Editing, and Deleting a Discovery

Overview of the Hybrid Audit Workflow Hybrid Audit Agent Deployment Hybrid Audit Installation Notes Working with Hybrid Audit Brokers Audited Events Page Overview Working with Protection Templates

Security Settings

Configuring a Forwarding Destination Managing Indicators

Muting and Unmuting Indicators

Managing Data Collections

Appendix - Available Audit Search Columns and Filters Appendix - Security Guardian Indicator Details

Indicators by Severity Indicators by Source

Indicators from Security Guardian Audit Indicators from Security Guardian Assessments Indicators from Security Guardian and Protection for Tier Zero Objects

Appendix - Data Collection Details

Active Directory Data Collection Details Microsoft Entra ID Data Collection Details

Documentation Roadmap

Best Practices built in searches

Audit provides the following Best Practices built in searches:

Microsoft Entra successful application consent events in the past 30 days
Sharing operations on important file types within past 7 days
Teams guest access enabled or disabled in the past 30 days

BloodHound Tier Zero assets built in searches

Audit provides the following BloodHound Tier Zero assets built in searches:

All Microsoft Entra Tier Zero AD risk events in the past 60 days
All Microsoft Entra Tier Zero application changes in the past 60 days
All Microsoft Entra Tier Zero group changes in the past 60 days
All Microsoft Entra Tier Zero principal logons in the past 60 days
All Microsoft Entra Tier Zero role changes in the past 60 days
All Microsoft Entra Tier Zero service principal changes in the past 60 days
All Microsoft Entra Tier Zero tenant level and directory activity in the past 60 days
All Microsoft Entra Tier Zero user changes in the past 60 days
All Tier Zero computer changes in the past 60 days
All Tier Zero domain and forest configuration changes in the past 60 days
All Tier Zero group changes in the past 60 days
All Tier Zero group policy item and object changes in the past 60 days
All Tier Zero user changes in the past 60 days
Local logons to Tier Zero computers in the past 60 days
Security changes to Tier Zero domain objects in the past 60 days
Security changes to Tier Zero group objects in the past 60 days
Security changes to Tier Zero group policy objects in the past 60 days
Security changes to Tier Zero computer objects in the past 60 days
Security changes to Tier Zero user objects in the past 60 days
Tier Zero user logons to computers that are not Tier Zero in the past 60 days

File System built in searches

Audit provides the following File System built in searches:

FS all events in the past 7 days
FS all permission and ownership changes to SYSVOL on domain controllers in the past 30 days
FS all local share changes in the past 30 days
FS all file and folder creates, deletes, and moves in the past 30 days
FS all file and folder attribute changes, modifications, and renames in the past 30 days
FS all file and folder auditing changes in the past 30 days
FS all file and folder ownership changes in the past 30 days
FS all file and folder permission changes in the past 30 days
FS all file and folder failed access attempts in the past 30 days
FS all file changes with suspicious file extensions in the past 30 days

Group Policy built in searches

Audit provides the following Group Policy built in searches:

Group Policy all events in the past 7 days
Group Policy all restricted group changes in the past 30 days
Group Policy all security changes in the past 30 days
Group Policy domain level linked changes in the past 30 days

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级