Change Auditor Threat Detection

Game over for rogue users with Change Auditor Threat Detection

Proactive user threat detection for Microsoft environments

Change Auditor Threat Detection offers a unique approach to user threat detection by modeling individual user behavior patterns to detect anomalous activity that might indicate suspicious users or compromised accounts. By analyzing user activity, using proprietary advanced learning technology, user and entity behavior analytics (UEBA), and sophisticated, scoring algorithms, Change Auditor Threat Detection ranks the highest risk users in your organization, identifies potential user threats and reduces the noise from false positive alerts. You’ll finally be able to overcome the gaps left behind by native auditing tools so you can keep your environment secure.

Download Free Trial Request Pricing

Features
Tour
Specifications
Resources

Features

Real-time audit log analysis

Efficiently analyze a high volume of audit data in real-time, including AD changes, authentications and file activity. Build user baselines from these raw activity events and proactively detect when users’ behavior appears anomalous so you’re immediately aware of potential suspicious activity.

Automated user behavior analytics (UEBA)

Model user activity patterns without any administrator input or configuration required. User behavior baselines are automatically created using unsupervised advanced machine learning, modeling every aspect of a user’s activity, including their logon patterns, administrative activity and file and folder access.

Sophisticated behavioral anomaly detection

Identify abnormal user activity by automatically comparing every user action against that user’s behavioral baseline. Sophisticated threat indicator detection and multi-level risk scoring ensure that only the most egregious anomalies are highlighted, representing the riskiest user behaviors.

High-fidelity user analytics

Change Auditor creates the audit logs feeding the analytics, so all of the raw event data being used to proactively detect threats in your environment inherently includes valuable information like:

Who made the change
What was changed
When was it changed
Where was it changed
And the IP address or workstation where the change originated

Unlike native Windows event logs, Change Auditor ensures no important user actions are missed which could otherwise create critical gaps in the user behavior analytics.

Pattern-based user threat detection

SMART user threat alerts are only raised when a correlated pattern of anomalous user behavior is detected. Rather than rely on rules to detect specific activities, automatically analyze all user activity as it happens and identify the most suspicious users in the environment through sophisticated user behavior pattern detection. Sophisticated global modeling ensures that only the most critical and concerning patterns of user behavior are highlighted, significantly reducing the noise caused by isolated activities and false positives.

Security alerts in context

Leverage existing Change Auditor infrastructure and audit data to model user behavior so there’s no need to deploy unnecessarily unwieldy additional agents and servers. A single virtual appliance is the only additional infrastructure required to enable advanced user threat analytics.

Tour

Dynamic dashboard

Dynamic dashboard displays the most suspicious user behaviors.

Proactive threat detection

Identify the real-time risk level of user activity to detect threats.

User behavior baselines

Model user behavior to create a baseline of typical user activity.

Anomaly detection

Find abnormal activity by comparing every action against the baseline.

Pattern-based detection

Display user threat alerts only when a pattern of suspicious behavior is detected.

Alerts in context

Suspicious activity alerts display all indicators as part of the alert.

Automated alert priority

Prioritize alerts based on the riskiest users in your environment.

Accelerated investigation

View complete alert background with analyses to speed investigations.

Download Free Trial Request Pricing

Specifications

Change Auditor System Requirements

For a full list of system requirements and required permissions for all components and target systems that can be audited by Change Auditor please refer to the Change Auditor Installation Guide.

Change Auditor Coordinator Requirements (Server-side component)

The Change Auditor coordinator is responsible for fulfilling client and agent requests and for generating alerts.

Processor: Quad core Intel® Core™ i7 equivalent or better

Memory: Minimum: 8 GB RAM or better

Recommended: 32 GB RAM or better

SQL Server

SQL databases supported up to the following versions:

Microsoft SQL Server 2008 R2 SP3
Microsoft SQL Server 2012 SP4
Microsoft SQL Server 2014 SP2

Microsoft SQL Server 2016 SP1
Microsoft SQL Server 2017

NOTE: Change Auditor does not support SQL high availability technology other than clusters.

Operating system

Installation platforms (x64) supported up to the following versions:

Windows Server 2008 R2 SP1
Windows Server 2012

Windows Server 2012 R2
Windows Server 2016

NOTE: Microsoft Windows Data Access Components (MDAC) must be enabled. (MDAC is part of the operating system and enabled by default.)

Coordinator software and configuration

For the best performance, we strongly recommend:

Install the Change Auditor coordinator on a dedicated member server.

The Change Auditor database should be configured on a separate, dedicated SQL server instance.

NOTE: Do NOT pre-allocate a fixed size for the Change Auditor database.

In addition, the following software/configuration is required:

The coordinator must have LDAP and GC connectivity to all domain controllers in the local domain and the forest root domain.
x64 version of Microsoft’s .NET 4.6.1

x64 version of Microsoft XML Parser (MSXML) 6.0
x64 version of Microsoft SQLXML 4.0

Coordinator footprint

Estimated hard disk space used: 1 GB
Coordinator RAM usage is highly dependent on the environment, number of agent connections, and event volume.

Estimated database size will vary depending on the number of agents deployed and audited events captured.

Change Auditor Threat Detection Server Requirements

The Change Auditor Threat Detection Server is a virtual appliance responsible for analyzing the audit logs from Change Auditor and detecting suspicious user behavior patterns. For more details on deploying the virtual appliance please refer to the Change Auditor Threat Detection Deployment Guide.

Platform