Increase Insight into Your Active Directory Environment

StealthAUDIT for Active Directory provides reporting features that give you great insight into your directory environment, but is there more usable information in a report than what is displayed by default?

Yes. Most StealthAUDIT Jobs collect and record additional information that is not necessarily included in the default presentation of reports. However, recent improvements to the report interfaces make both filtering on, and utilization of, this data more accessible.

Let’s use our Stale Users report as an example. This report draws on data stored in the AD_StaleUsers_UserDetails table. Although this table contains data collected on the user objects’ DistinguishedName attribute, a column for this attribute (and thus the data itself) is not displayed by default in the Stale Users report.

Previous versions of StealthAUDIT required you to (re-)configure the manner in which the report would be generated by selecting a new Report Element through the Field Chooser. Desired columns from the table would need to be manually added and then the report would have to be regenerated, like below:

Now (with StealthAUDIT version 7.1 and later), instead of having to redefine how the Stale Users report is generated, we can easily select any “missing” columns for inclusion by interacting directly with the report within the Report Index itself. Simply navigate to the Stale Users report, right-click the Column Header, and all available columns will be displayed:

Including the Distinguished Name column in this way now also makes it available as a filtering criterion within the report itself. And since components of the Distinguished Name contain OU information about the user object, I can now filter by a specific OU and see the related information regarding user staleness:

Here I’ve filtered by a known Test Account OU that I have created, but it can be set to filter to “VIP,” “Service,” or whatever OU is desired. There’s plenty of additional data in existing reports that can now be accessed right off the Report Index, making it even easier to get the data you need. Your reports’ Column Headers are ready and waiting to be right-clicked: be sure to explore this new Report Index feature!

Don’t miss a post! Subscribe to The Insider Threat Security Blog here:

Name

Email*