IT Security Search
Correlate disparate IT data into an interactive search engine
Seeing the un-seeable can be a challenge for IT. With billions of events to collect and review from a variety of sources, both on premises and in the cloud, it’s difficult to find relevant data and make sense of it. And in the event of a security breach, either internal or external, the ability to locate where the breach originated and what was accessed can make a world of difference.
IT Security Search is a Google-like, IT search engine that enables IT administrators and security teams to quickly respond to security incidents and analyze event forensics. The tool’s web-based interface correlates disparate IT data from many Quest security and compliance solutions into a single console and makes it easier than ever to:
- Reduce the complexity of searching, analyzing and maintaining critical IT data scattered across information silos
- Speed security investigations and compliance audits with complete real-time visibility
- Troubleshoot widespread issues should an outage or security breach occur
- Configure role-based access, enabling auditors, help desk staff, IT managers and other stakeholders to get exactly the reports they need and nothing more
Features
IT Security Search is available as part of several Quest solutions including Enterprise Reporter, Change Auditor, InTrust, Recovery Manager for AD, and Active Roles that pulls data and feeds it into a single pane of glass. From here, you can easily review and act upon all of the various activities in your on-premises or hybrid environment.
State-based data
- Gain critical insights into user, computer and group information, direct and nested group memberships, OU and file/folder permissions, ownership and more across on-premises, Azure and hybrid environments with Enterprise Reporter. Empower IT teams to comprehensively understand their state of security.
- View virtual attributes, dynamic group members, temporal group members and managed units from Active Roles
Real-time security auditing
- Search real-time information about changes to critical objects and sensitive data, whether on premises or in Office 365 and Azure Active Directory (AD), with Change Auditor.
- Supplement native audit details with the actual user who initiated a change to AD, even if it was initiated through Active Roles
Collect and archive logs
Gather native (Windows server, Unix/Linux, workstation and more) logs as well as third-party logs from across your diverse enterprise network with InTrust log management.
Compressed, indexed, online repository
Conduct full-text search on long-term event log data and other server data for compliance and security purposes with InTrust, saving time spent looking for events.
Object recovery
Discover which AD objects have changed, including before and after values, and restore them in a few clicks with Recovery Manager for AD.
Tour
Events
Files
Users
Contextual filters
Forensic incident response
Specifications
- Compatibility
-
The following versions of data-providing systems are supported in this version of IT Security Search:
- InTrust 11.4, 11.3.2, 11.3.1, 11.3, 11.2
- Change Auditor 7.0, 6.9.5, 6.9.4, 6.9.3, 6.9.2, 6.9.1, 6.9, 6.8
- Enterprise Reporter 3.1, 3.0, 2.6, 2.5.1
- Recovery Manager for Active Directory 9.0.1, 9.0, 8.8.1, 8.8, 8.7.1, 8.7
- Active Roles 7.3.1, 7.2.1, 7.2, 7.1, 7.0
- Software Requirements
-
- Operating system:
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2012
- Microsoft Windows Server 2008 R2
- Additional software:
- Microsoft .NET Framework 4.6.2 or later
- Microsoft Windows PowerShell 3.0 or later
- Microsoft SQL Server 2012 or later (all editions). This is a requirement of the IT Security Search Warehouse component, which needs it for internal configuration management.
Additional requirements for the Recovery Manager for Active Directory connector:
- Enable remote commands in Windows PowerShell. For details, see https://technet.microsoft.com/en-us/magazine/ff700227.aspx.
- The PowerShell script execution policy must be set to RemoteSigned. Run the following cmdlet:Set-ExecutionPolicy RemoteSigned
Additional requirements for the Active Roles connector:
- Active Roles Management Tools
- The PowerShell script execution policy must be set to RemoteSigned.
- Operating system:
- Browser Compatibility
-
The IT Security Search Web interface works correctly with the following browsers:
- Microsoft Edge
- Microsoft Internet Explorer 11 or later
- Google Chrome 72.0 or later
- Mozilla Firefox 65.0 or later
The minimum supported monitor resolution is 1024x768.
- Hardware Requirements
-
- CPU: 6 cores minimum; 16 cores recommended
- RAM: 8GB minimum; 16GB or more recommended
- Disk: 200GB (SSD recommended); disk space requirements are very dependent on the volume of Enterprise Reporter data being processed, because the index size varies proportionally; the indexes for Change Auditor and InTrust data do not consume any disk space on the IT Security Search computer, because they are located in the data stores used by these systems
- If you deploy on a virtual machine, make sure the CPU and memory requirements above are met, and do not overload the virtual machine host
To find out the disk requirements for IT Security Search installation please refer to the IT Security Search Support Page.
Resources
IT Security Search
Easily correlate disparate IT data into an interactive search engine.
Investigating GPO changes with IT Security Search
Learn how to investigate GPO changes with IT Security Search from Quest.
Investigating account lockouts with IT Security Search
In this short video, learn how to investigate account lockouts with IT Security Search.
SIEM Integration Best Practices: Making the Most of Your Security Event Logs
Too many organizations limit the log data they collect because they can't afford to process everything their SIEM; it simply costs too much and generates far too many alerts. However, this decision
Deciding Which Security Event Logs to Collect and How to Process Them in Your SIEM and Beyond
Using SIEM to check every log with security value can be overwhelming and costly. Collecting logs is vital to detecting, analyzing and preventing security breaches, but not every log has to be sent
How to Mitigate the Insider Threat
This eBook provides solutions to stop insider threats, manage privileged accounts, simplify GPO management and administration.
5 Administrative Tasks Made Easy with IT Security Search
In this webcast, learn how to simplify and enhance Active Directory administration and security with IT Security Search.
How to Improve your SIEM’s ROI and Threat-Hunting Potential
Are you getting maximum value from your SIEM? Probably not — 54 percent of cybersecurity pros say that their SIEM detects less than half of all security incidents, and many organizations have
- More Resources
- Events & Demos
- Research Docs
- Videos
Take the next step
Related Products
Enterprise Reporter
Simplify Microsoft on-premises and cloud-based platform security and compliance reporting
InTrust
Securely collect, store and receive event data from Windows, Unix and Linux systems
Recovery Manager for Active Directory
Reduce backup recovery time and costs to reduce user impact
Support & Services
Product Support
Self-service tools will help you to install, configure and troubleshoot your product.
Support Offerings
Find the right level of support to accommodate the unique needs of your organization.