Active Directory Audit and Monitoring

The National Institute of Standards and Technology (NIST) cybersecurity framework (https://www.nist.gov/cyberframework) is based on three main things: protect, detect, and respond. All these components are connected to one another. When we implement a system, we first need to understand what to protect and how to protect it. So far in this book, I've explained the importance of an identity infrastructure and how and what we can do to protect it from emerging threats. Based on that, we can build a protected identity infrastructure, but we should understand that we can't close all the doors. We need to expect a breach at any time. But when it happens, we should have a system in place to detect it and notify us. This allows us to respond to the situation quickly and to minimize damage. In order to detect similar incidents, it is important...