You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| All AD Changes | Gathers all AD changes. Utilizes the built-in “Exclude Class” – Classes Collection and “Exclude Attribute” – Attributes Collection to restrict unwanted events. Add classes and attributes which will NOT be monitored to these collections | None |
16
-
| All GPO Setting Changes | No customizations required to monitor all GPO setting changes | None |
| All AD Changes | Gathers all AD changes. <br />Utilizes the built-in “Exclude Class” – Classes Collection and “Exclude Attribute” – Attributes Collection to restrict unwanted events. Add classes and attributes which will NOT be monitored to these collections | None |
16
+
| All GPO Setting Changes | No customizations required to monitor all GPO setting changes | None |
| Non-Owner Logon Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Specify the Exchange Mailboxes and Containers to lockdown. Optionally, add Exchange Perpetrators to be allowed or denied. | None |
| Non-Owner Logon Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Specify the Exchange Mailboxes and Containers to lockdown. Optionally, add Exchange Perpetrators to be allowed or denied. | None |
| File Owner Changes | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded. | None |
35
-
| File System Monitoring | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded. Reads are left out due to the potential high volume of data that could be gathered; recommended only for highly sensitive content. | None |
| File Owner Changes | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded. | None |
35
+
| File System Monitoring | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded. <br />Reads are left out due to the potential high volume of data that could be gathered; recommended only for highly sensitive content. | None |
| AD Object Permissions Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “Object Permissions <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Objects to protect.</li></ul> | None |
48
-
| AD Root Object Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “Root Object <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Objects to protect.</li></ul> | None |
49
-
| Critical GPO Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “Critical GPO <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired GPOs to protect.</li></ul> | None |
50
-
| DNS Record Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “DNS Records <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, and fill in the built-in collection.</li></ul> | None |
51
-
| Group Lockdown of Delete, Move, Rename, and Membership Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “Group Lockdown <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Groups to protect.</li></ul> | None |
52
-
| Group, User, and OU Lockdown of Delete, Move, and Rename Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “Group User OU Object Delete and Move <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Objects to protect.</li></ul> | None |
53
-
| OU Structure Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “OU Structure <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired OUs to protect.</li></ul> | None |
54
-
| User Lockdown of Delete, Move, Rename and Modify Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Utilizes the built-in “User Lockdown <ul><li>Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, and fill in the built-in Allow Lockdown Perpetrator Collection, and add the desired Users to protect.</li></ul>| None |
| AD Object Permissions Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “Object Permissions - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Objects to protect. | None |
48
+
| AD Root Object Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “Root Object - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Objects to protect. | None |
49
+
| Critical GPO Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “Critical GPO - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired GPOs to protect. | None |
50
+
| DNS Record Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “DNS Records - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, and fill in the built-in collection. | None |
51
+
| Group Lockdown of Delete, Move, Rename, and Membership Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “Group Lockdown - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Groups to protect. | None |
52
+
| Group, User, and OU Lockdown of Delete, Move, and Rename Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “Group User OU Object Delete and Move - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired Objects to protect. | None |
53
+
| OU Structure Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “OU Structure - >Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the desired OUs to protect. | None |
54
+
| User Lockdown of Delete, Move, Rename and Modify Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES <br />Utilizes the built-in “User Lockdown - Allow Perpetrators” – Lockdown Perpetrators Collection. <br />Change the AD Perpetrator tab to ALLOW instead of BLOCK, and fill in the built-in Allow Lockdown Perpetrator Collection, and add the desired Users to protect. | None |
Copy file name to clipboardExpand all lines: docs/threatprevention/7.4/admin/templates/folder/filesystem.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,7 +28,7 @@ recommended only for highly sensitive content.
28
28
|| WinFS: Video File Access | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded | None |
29
29
| Access | WinFS Access: Creates | Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
30
30
| Access | WinFS Access: Deletes | Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
31
-
| Access | WinFS Access: Reads | USE CAUTION WITH THIS TEMPLATE Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
31
+
| Access | WinFS Access: Reads | USE CAUTION WITH THIS TEMPLATE <br />Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
32
32
| Access | WinFS Access: Renames | Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
33
33
| Access | WinFS Access: Writes | Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
34
34
| Properties | WinFS Property: Attribute Modifications | Specify the files and/or folders to be monitored. Optionally, add any ‘Wildcards’ and/or AD Perpetrators to be included or excluded | None |
0 commit comments