Continuous monitoring and auditing is a must for an identity infrastructure to identify potential security threats and maintain a healthy environment. There are a lot of tools and methods out there to do this, but the success of these solutions depends on the accuracy of detection, the way it presents data, and how it helps in identifying the root cause.
In this chapter, we started by looking at Windows' in-built tools and methods t can be used to monitor and audit AD environments. First, we started with GUI tools and then moved to PowerShell-based auditing. Then we looked at Microsoft ATA and how it can help to identify security threats in the infrastructure that cannot be detected using traditional tools and methods. Later, we looked at the Microsoft Cloud-based advanced monitoring and log analytics solution, Azure Monitor. Using a demonstration, I also explained...
