Continuous monitoring and auditing is a must for an identity infrastructure to identify potential security threats and maintain a healthy environment. There are a lot of tools and methods out there to do this, but the success of these solutions depend on the accuracy of detection, the way it presents data, and how it helps identify the root cause.
In this chapter, we started with looking at Windows inbuilt tools and methods which we can use to monitor and audit Active Directory environments. First, we started with GUI tools and then moved to PowerShell-based auditing. Then we looked at Microsoft ATA and how it can help identify security threats in the infrastructure that cannot be detected using traditional tools and methods. Last but not least, we looked at the Microsoft cloud-based advanced monitoring and log analytics solution, OMS. Using a demo, I also explained how...
