LT Auditor+ Best Practices Logon Activity

Показать описание

Logon Activity displays data that tracks logon activity in the organization. Details of each of the panels and visuals in this category are described below:

Lockouts
Account Lockouts can happen for a variety reasons, however from an organizational standpoint they are disruptive and costly. With the Lockouts Panel administrators or security personnel can quickly analyze lockout activity by:

• Identifying the source machine where lockouts are occurring for quick remediation.
• Finding users with the most lockout activity and facilitate training to reduce downtime.
• Investigating suspicious lockout activity based on number of incidents and location.
• Providing data to discuss review of the organization’s Account Lockout policy based on the patterns of lockout activity.

Failed Logons
A large number of failed logon attempts occurring within a certain period of time could be an indication of a security threat. The Failed Logons Panel provides critical information identifying all logon failures and provides important information to:

• Identify users and nodes where very large number of failures occurred.
• Show trend lines over time to help investigate security incidents if a pattern of attack is identified.
• Displays clear reasons for logon failures.

Privileged User Logons
Privileged users have access to most critical resources in an organization. The prime objective of most attackers is to compromise a privileged account to either exfiltrate information or hijack an organization with ransomware demands. Tracking privileged user activity is a critical part of any organization’s security footprint and important for compliance and governance.

The Privileged Users Logons Panel tracks all successful and unsuccessful logon activity for privileged users in the organization.

Suspicious Failed Logons
Multiple failed logins from a single user to different nodes or machines is an extremely suspicious pattern of activity that might indicate a malware infection. This could be a situation where malware on an infected host machine is attempting to move laterally within an organization.

The Suspicious Failed Logons Panel displays all failed logons of valid users that have attempted access to multiple nodes in the organization allowing investigators to quickly pinpoint machines that may have malware.

Suspicious Logons
Multiple successful logons from a single user to different nodes or machines is another extremely suspicious pattern of activity that might indicate a malware infection. This could be a situation where malware on an infected host machine is successfully got the right user credentials is moving laterally within an organization.

The Suspicious Logons Panel displays all successful logons to multiple nodes in the organization allowing investigators to quickly pinpoint machines that may have been infested.