Makore akati wandei apfuura, patakatanga kuita Shanduko Auditor mubhangi rimwe, takaona rondedzero hombe yezvinyorwa zvePowerShell izvo zvakaita basa rakafanana rekuongorora, asi tichishandisa nzira yekuchinja. Nguva yakawanda yapfuura kubva ipapo, mutengi achiri kushandisa Shandura Auditor uye anoyeuka kutsigirwa kweaya manyoro ese sekurota kwakaipa. Hope idzodzo dzaigona kunge dzakashanduka kuita hutsinye kana munhu aishandira zvinyorwa mumunhu mumwechete akangosiya, nekuchimbidza kukanganwa kuendesa ruzivo rwakavanzika. Takanzwa kubva kune vatinoshanda navo kuti nyaya dzakadai dzinoitika pano neapo uye izvi zvakabva zvaunza nyonga nyonga pabasa rebazi rinoona nezvekuchengetedzwa kwemashoko. Muchikamu chino, tichataura nezve mabhenefiti makuru eShanduro Auditor uye zivisa webinar muna Chikunguru 29 pane ino otomatiki chishandiso. Pazasi pekuchekwa pane zvese zvese.
Iyo skrini iri pamusoro inoratidza iyo IT Chengetedzo Yekutsvagisa webhu interface ine google-yakafanana yekutsvaga bar, mairi zviri nyore kuronga zviitiko kubva Shandura Auditor uye kugadzirisa maonero.
Shandura Auditor chishandiso chine simba chekuongorora shanduko muMicrosoft infrastructure, disk arrays uye VMware. Odhiti inotsigirwa: AD, Azure AD, SQL Server, Exchange, Exchange Online, Sharepoint, Sharepoint Online, Windows File Server, OneDrive yeBhizinesi, Skype yeBhizinesi, VMware, NetApp, EMC, FluidFS. Kune pre-yakaiswa mishumo yekutevedzera GDPR, SOX, PCI, HIPAA, FISMA, GLBA zviyero.
Metrics inounganidzwa kubva kuWindows maseva nenzira-yakavakirwa-mumiririri, iyo inobvumira kuongorora uchishandisa yakadzika kusanganisa mukufona mukati meAD uye, sekunyora kunoita mutengesi, iyi nzira inoona shanduko kunyangwe mumapoka akadzika matendere uye inounza mutoro wakaderera pane pakunyora, kuverenga uye. kudzoreredza matanda (ndiwo mashandiro avanoita ) Unogona kuzvitarisa pamutoro mukuru. Nekuda kweiyi yakaderera-chikamu kubatanidzwa, muKutsvaga Shanduko Auditor unogona kuvhota dzimwe shanduko kune zvimwe zvinhu, kunyangwe kune vashandisi pa Enterprise Admin level. Kureva kuti, zvidzivirire kubva kuvakuru vane hutsinye hweAD.
MuShanduro Auditor, shanduko dzese dzakajairwa kumhando ye5W - Ndiani, Chii, Kupi, Rini, Nzvimbo yekushanda (Ndiani, Chii, Kupi, Rini uye pane nzvimbo yekushandira). Iyi fomati inobvumidza iwe kubatanidza zviitiko zvakagamuchirwa kubva kwakasiyana masosi.
Musi waChikumi 2, 2020, vhezheni itsva yeChange Auditor yakaburitswa - 7.1. Iine zvinotevera zvakakosha kuvandudzwa:
- Pass-the-Ticket kutyisidzira kuona (kuzivikanwa kweKerberos Matikiti ane zuva rekupera iro rinopfuura iyo domain policy, iyo inogona kuratidza inogona kuitika yeGoridhe Tiketi kurwisa);
- Ongororo yeyakabudirira uye isina kubudirira NTLM authentication (unogona kuona iyo NTLM vhezheni uye kuzivisa nezve maapplication anoshandisa v1);
- ongororo yezvakabudirira uye zvisina kubudirira zveKerberos;
- Kuendesa maAudit agents mune yakavakidzana AD sango.
Iyo skrini inoratidza kutyisidzira kwakaonekwa ine nguva yakareba yechokwadi yeKerberos Tiketi.
Pamwe chete nechimwe chigadzirwa kubva kuKuda - PaKuda Odhita, unogona kuongorora nharaunda dzakasanganiswa kubva kune imwechete interface uye kutarisa logon muAD, Azure AD uye shanduko muHofisi 365.
Imwe mukana weChanduko Auditor mukana wekunze-kwe-bhokisi kubatanidzwa neSIEM system zvakananga kana kuburikidza nechimwe chigadzirwa cheKuda - InTrust. Kana iwe ukamisa kubatanidzwa kwakadaro, unogona kuita otomatiki zviito kudzvanya kurwiswa kuburikidza neInTrust, uye mune imwecheteyo Elastic Stack unogona kuseta maonero uye kupa mukana kune vaunoshanda navo kuti vaone nhoroondo data.
Kuti udzidze zvakawanda nezve Change Auditor, tinokukoka iwe kuti uende kune webinar, iyo ichaitika muna Chikunguru 29 na11 am Moscow nguva. Mushure mewebhu webinar iwe unozogona kubvunza chero mibvunzo yaungave uine.
Zvimwe zvinyorwa pamusoro peKutsvaga kuchengetedza mhinduro:
Iwe unogona kuendesa chikumbiro chekubvunza, kugovera kana chirongwa chekuyedza kuburikidza pawebhusaiti yedu. Panewo tsananguro dzemhinduro dzakarongwa.
Source: www.habr.com