Active Directory Real-Time Monitoring

Active Directory Real-Time Monitoring

SmartProfiler for Active Directory provides Active Directory Real Time Monitoring component. The AD Real-Time can help you continuously monitor Active Directory for security risks and notify you via email. SmartProfiler alerts for Active Directory must be configured before the SmartProfiler AD Real-Time Agent can work. The alert configuration requires that you provide inputs to some of the alerts. Note that SmartProfiler Active Directory Real-Time Monitoring is a flexible component – it allows you to add custom alerts based on your requirements.

Why Active Directory Real-Time Monitoring is needed?

Active Directory Real Time Monitoring is required for maintaining the security, integrity, and availability of an organization’s network infrastructure. Here are a few important points as to why Active Directory Real-Time Monitoring is important. Active Directory Real-time monitoring allows you to detect and respond to security incidents as they occur, rather than after the fact. By continuously monitoring AD activities, such as user logins, privilege changes, or group membership modifications, organizations can identify suspicious behavior indicative of unauthorized access attempts, insider threats, or malware infections.

Someone is “securing” something, and someone else is “breaking” something. Attackers just need to employ the 30–35 approaches listed in order to get access to Active Directory, but security personnel must employ all available technological tools in order to defend the environment from attackers. When we say, “all technical means,” we mean looking at Active Directory from the standpoints of attackers and AD upkeep.

What you should monitor as part of Active Directory Real-Time Monitoring?

There are many components in an Active Directory System. It becomes difficult to monitor all components of Active Directory. However, there are some key components to monitor as part of Active Directory real-time monitoring. User Logon and Authentication Events, Privileged Account Activity, Changes to Group Memberships, Configuration Changes, Replication Status and Health, Directory Object Modifications and other aspects of Active Directory.

SmartProfiler for Active Directory can monitor above and be able to generate an email alert if the issues are found.

Configuring Real Time Alerts for Active Directory

To configure Real Time Alerts for Active Directory, click on “Configure Alerts” button under Active Directory Security section in left pane. SmartProfiler for Active Directory is a robust tool for Active Directory Real-Time Monitoring ensure it captures all threats and notify immediately.

Active Directory Real-Time Monitoring

Note that there are 141 alerts that ship with SmartProfiler for Active Directory. The SmartProfiler Real-Time Agent is a service that is responsible for executing these alerts and sending notifications. There are three types of alerts available with SmartProfiler for Active Directory:

  • Alerts that require Initialization
  • Alerts that require some inputs
  • Alerts that can run as is.

Alerts that require initialization

There are alerts in SmartProfiler that require initialization. For example, for alert “Notify if the FSMO Role Hoder Changes”, the SmartProfiler needs to know the current placement of FSMO in all AD Domains. Once it knows it checks the current FSMO role holders in database and compare every time it runs. If it finds any changes, then those changes will be notified via email. If you check the option “Filter Alerts that require Initialization” option then you will get the list of alerts that require initialization.

Note: If any alert requires initialization and has not been initialized then you will see “Not Initialized” in the red color in the grid.

Alerts that require some inputs

There are a few alerts that require some inputs before SmartProfiler AD Real-Time Agent can process them. For example, the alert “Notify if an Active Directory account is used” requires that you provide the SamAccountName of the user whose account needs to be audited.

Alerts that can run as is.

Alerts that can run as is do not require initialization and inputs. For example, “Notify if the AdminSDHolder Permissions Changes” alert checks to ensure the permissions are not modified on the AdminSDHolder Object. If they are modified, then you will get a notification.

Understanding Alert Columns in Grid

The Active Directory Real-Time Monitoring requires configuring alerts. Each alert has parameters associated with it as explained below:

  • Alert: The actual alert name.
  • Status: Indicates whether the alert is enabled or disabled.
  • Items: The alert items if applicable. For example, items can be a SamAccountName, DistinguishedName of an object, etc.
  • Email Template: Email Template which is applied to the alert. Note that each alert can have same or separate email templates.
  • AD Domain: AD Domain name for the alert.
  • Initialization Status: The initialization status of the alert. If the alert is not initialized then you will see “Not Initialized” in red color. If the alert is initialized then you will see “Initialized” in the green color.
  • Email Notification: Indicates whether the email needs to be sent or not.
  • Indicator: The indicator indicates IOC, IOE or both.

Initializing Active Directory Alerts

To ensure SmartProfiler Active Directory Real-Time Monitoring Agent can work as expected, please ensure to initialize alerts. You can initialize all alerts or single alert from the console.

To start initializing all alerts, click on “Initialize All Alerts” button on the action bar. Once you click on the option, the process will check all alerts and initialize them. If any of the alerts require input then those need to be rectified before the initialization can happen.

To initialize a single alert, click on “Initialize” button in the grid as shown below:

Active Directory Real Time Alerts

Note: Please ensure to configure the alert parameters before initializing.

Configuring Active Directory Alert

To configure an alert, click on the alert in the Grid and then modify the options. As you can see, I clicked on the “Notify if an Active Directory Account is used” alert which shows the parameters configured for the alert.

Configuring Alerts Parameters

The following parameters can be modified for the alert:

  • Alert Status: Only two values are available; Enabled/Disabled. The disabled alerts will not be processed by SmartProfiler Real-Time AD Agent.
  • Target Domain: By default, all alerts apply to AD Forest. If you wish to process a particular alert for a single AD Domain then select the AD Domain in the dropdown.
  • Email Template: Select the email template that applies to this alert.
  • Email Notification: You can turn on and off the email notification for a particular alert.
  • Enter Alert Items If Applicable: Here you need to enter the alert items. For example, in case of current alert, you need to enter the SamAccountName of Active Directory user which you want to monitor.

Once you have configured alert parameters, click on “Save Alert Settings” button to save the alert configuration.

In case you wish to apply same Email Template, same AD Domain, or same Email Notification status to all alerts then click on the respective icon marked in the red circle in below screenshot:

Applying Alerts Settings to All Alerts

Once all alerts are configured and initialized, the SmartProfiler Real-Time AD Agent will process them.

Using SmartProfiler Real Time Console

The Real-Time Console for Active Directory has been designed to help you understand overall status of all alerts in one screen. The Real-Time Console provides following features:

  • Can show status of all alerts.
  • Let you modify the number of columns to be displayed in the screen.
  • Shows number of alerts requiring attention.
  • Shows number of alerts passed.
  • Shows number of alerts resulted in error.
  • Show Modified data for alert, if any.
  • Start/Stop the AD Real-Time Agent Service

To open the Real-Time Console, click on “Real-Time Console” button in the left pane under “Active Directory Security”.

Active Directory Real Time Console

When you first open the Real-Time Console it will refresh and show the alerts status from the agent. In case you need to refresh alerts status, you can do so by clicking on the Refresh icon.

Showing Alert Data

The Real-Time Console is capable of showing modified data for an alert. For example, if the FSMO Role Holder changes, the alert will display what changed and when changed.

To see the alert data, click on any of the alerts, which, in turn, will show below window:

Checking Active Directory Real Time Data for an alert.

In the Log tab you can see alert activities and in the Data tab you can see alert data. Note that if an alert required initialization, then initialized data will appear in the “Initialized Data” pane and current data and modified data will appear in “Current Data” and “Modified Data” panes.

Right Click Context Menu for Alert

Note that each alert supports Right Click Context menu as shown below:

Right Click Context Menu for an Alert in SmartProfiler

The right click context menu actions are quick actions that you can take for an alert as explained below:

  • Show Attributes: Displays attributes for selected alert.
  • Initialize Alert: Initialize selected alert.
  • Disable Email Notification: Disable the email notification for selected alert.
  • Show Alert Log: Displays log for selected alert.

Email Notifications by Agent

If the email notification is enabled for an alert, then you will receive an email notification as shown below:

Email Notification by SmartProfiler for Active Directory Real Time Alerts

All alerts, as part of Active Directory Real-Time Monitoring, highlighted here as part of the Active Directory assessment are also recommended by ANSSI, MITRE and Microsoft.

Try SmartProfiler, a unified tool to help with security evaluation across many Microsoft technologies.

Translate »
Index