立即与支持人员聊天

获得即时帮助
完成注册

登录

请求定价

联系销售人员

免费试用版

Security Guardian Current - User Guide

Introducing Quest Security Guardian

About On Demand

Accessing Quest On Demand Supported regions Access Control

About Security Guardian

Functional Overview Configuring Additional Components

Using the Dashboard

Configuring Audit

Working with tenants Granting required consent Configuring tenant auditing Historical event collection Change Auditor Integration

Customer data storage Registering a Change Auditor Installation Pausing Change Auditor event forwarding Resuming Change Auditor event forwarding Removing a Change Auditor Installation Reviewing the status of your Change Auditor installation

SpecterOps BloodHound Enterprise Integration

Configure a SpecterOps BloodHound Integration

Working with Audit

Using the Audit Dashboard

Working with Activity Indicators Monitoring Audit Health status Identifying critical activity Identifying the top active users Working with My Favorite Searches Monitoring sign-in trends

Searching for specific event data (Quick Search) Working with critical activity Working with searches

Working with private and shared searches Running a search Using built in searches

Active Directory Built in searches Active Directory Federation Services built in searches Active Directory Database built in searches Anomaly Activity built in searches Audit Health built in searches Microsoft Entra built in searches Best Practices built in searches BloodHound Tier Zero assets built in searches File System built in searches Group Policy built in searches Logon Activity built in searches Microsoft 365 built in searches On Demand Audit built in searches Teams built in searches Security Guardian built in searches

Filtering Searches Creating a custom search Copying an existing search Exporting a search Creating a search from an existing search Customizing the search display Viewing search results and event details Copying event details Modifying a search Deleting a search Working with categories

Working with alerts and notification templates

Using built in alerts and notification templates

Auditing Microsoft Entra

Event collection and Microsoft Entra subscription Working with Microsoft Entra Searches Working with Microsoft Entra events with multiple targets Auditing risk events

Auditing Microsoft 365

Investigating Findings

Investigating Tier Zero and Privileged Object Findings Investigating Hygiene and Detected Indicators

Using Security Guardian Intelligence with Findings Muting Findings for Hygiene and Detected Indicators Dismissing Findings Viewing Finding History

Tier Zero Objects

How Tier Zero Objects are Identified Tier Zero Objects List Viewing Tier Zero Object Details Adding Tier Zero Objects Manually

Removing Manually-Added Tier Zero Objects

Certifying Tier Zero Objects Protecting Tier Zero Objects Exporting the Tier Zero Objects List

Shields Up Protection (Prevention)

Using Shields Up Enabling Shields Up Disabling Shields Up Override Access for Protected Objects

Privileged Objects

Privileged Objects List Viewing Privileged Object Details Adding Privileged Objects Manually

Removing a Manually-added Privileged Object

Certifying Privileged Objects Exporting the Privileged Objects List

Managing Workload Identities

Viewing Workload Identity Details Setting Workload Identity Category Reloading Workload Identities

First Assessment Notification Email Built-in Assessments Using Security Guardian Intelligence with Assessments All Assessments List Creating an Assessment Viewing, Editing, and Deleting an Assessment Viewing Assessment Summary Information Assessment Results

Viewing Details for an Assessed Vulnerability

Discoveries and Vulnerabilities

Discoveries List Pre-Defined Active Directory Discoveries

Additional Permissions Required for Specific Vulnerabilities Discovery for Credential Access Vulnerabilities Discovery for Defense Evasion Vulnerabilities Discovery for Discovery Vulnerabilities Discovery for Initial Access Vulnerabilities Discovery for Lateral Movement Vulnerabilities Discovery for Persistence Vulnerabilities Discovery for Privilege Escalation Vulnerabilities Discovery for Reconnaissance Vulnerabilities

Pre-Defined Entra ID Discoveries

Entra ID Vulnerabilities that Require a Premium License Discovery for Entra ID Credential Access Vulnerabilities Discovery for Entra ID Discovery Vulnerabilities Discovery for Entra ID Initial Access Vulnerabilities Discovery for Entra ID Persistence Vulnerabilities Discovery for Entra ID Privilege Escalation Vulnerabilities

Creating a Discovery Viewing, Editing, and Deleting a Discovery

Overview of the Hybrid Audit Workflow Hybrid Audit Agent Deployment Hybrid Audit Installation Notes Working with Hybrid Audit Brokers Audited Events Page Overview Working with Protection Templates

Security Settings

Configuring a Forwarding Destination Managing Indicators

Muting and Unmuting Indicators

Managing Data Collections

Appendix - Available Audit Search Columns and Filters Appendix - Security Guardian Indicator Details

Indicators by Severity Indicators by Source

Indicators from Security Guardian Audit Indicators from Security Guardian Assessments Indicators from Security Guardian and Protection for Tier Zero Objects

Appendix - Data Collection Details

Active Directory Data Collection Details Microsoft Entra ID Data Collection Details

Documentation Roadmap

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级