Skip to content

Commit c570f69

Browse files
farzanajafarfarzanajafar
authored
Merge pull request #74 from netwrix/Farzana/NTM3.0-tables
Farzana/ntm3.0 tables
2 parents a3fcb49 + 56578ea commit c570f69

File tree

15 files changed

+115
-158
lines changed

15 files changed

+115
-158
lines changed

‎docs/threatmanager/3.0/administration/configuration/threatdetection/threatconfiguration.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ The Processing tab contains the configuration options for processing the threat.
2020

2121
![This screenshot displays the Processing tab.](/img/product_docs/threatmanager/3.0/administration/configuration/processingtab.webp)
2222

23-
General:
23+
**General:**
2424

2525
- Status – When set to ON, this threat will be detected by Threat Manager. When set to OFF, this
2626
threat will not be detected by Threat Manager. When a threat status is **OFF**and then set to
@@ -45,7 +45,7 @@ General:
4545
- Informational – Indicates first-time client use or first-time host use, which can be common
4646
events but may also indicate a threat
4747

48-
Threat Response:
48+
**Threat Response:**
4949

5050
Assigning a threat response designates a playbook to automatically be executed immediately when a
5151
threat of this type is detected.
@@ -56,7 +56,7 @@ threat of this type is detected.
5656
detected. Select Off to turn off forwarding threat information to a SIEM service.
5757
- Run Playbook – Select the playbook that will be used to respond to the threat.
5858

59-
Rollup:
59+
**Rollup:**
6060

6161
**NOTE:** Rollup is not available for all threat types.
6262

‎docs/threatmanager/3.0/administration/investigations/auditcompliance.md‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -27,19 +27,19 @@ Every report generated by an investigation query displays the same type of infor
2727

2828
By default, this folder contains the following saved investigations:
2929

30-
| Investigation | Description | Filters |
31-
| -------------------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32-
| AD Changes | All Active Directory changes | One filter statement set: - Attribute = Event Operation - Operator = Equals - Filter = Active Directory Change |
33-
| AD Changes by Domain Admins | All Active Directory changes by Domain Admins | Two filter statements set: - Attribute 1 = Event Operation - Operator 1 = Equals - Filter 1 = Active Directory Change AND - Attribute 2 = Tag (Effective) - Operator 2 = Equals - Filter 2 = Domain Admin |
34-
| AD Logins | Active Directory logins including Kerberos and NTLM authentication | One filter statement set: - Attribute = Event Operation - Operator = Equals - Filter = Active Directory Authentication |
35-
| All Events | New Investigation | No filters set |
36-
| Confirmed Compromised Account Activity | Occurs when a Confirmed Compromised Account is being active within an Entra ID tenant | One filter statement set: - Attribute = Tag (Direct) - Operator = Equals - Filter 1 = Confirmed Compromised |
37-
| Failed AD Logins | All failed Active Directory logins including Kerberos and NTLM authentication | Two filter statements set: - Attribute 1 = Event Operation - Operator 1 = Equals - Filter 1 = Active Directory Authentication AND - Attribute 2 = Success - Operator 2 = Equals - Filter 2 = false |
38-
| Failed Entra ID Logins | Occurs when an Entra ID login attempt has failed | Two filter statements set: - Attribute = Event Operation - Operator = Equals - Filter 1 = EntraID Sign-In And - Attribute = Success - Operator = Equals - Filter 2 = False |
39-
| LDAP Search | All LDAP search events | One filter statement set: - Attribute = Event Operation - Operator = Equals - Filter = LDAP Search |
40-
| Privileged Account Activity | All activity by privileged accounts | One filter statement set: - Attribute = Tag (Direct) - Operator = Equals - Filter = Privileged |
41-
| Risky User Activity | Occurs when a Risky User is being active within an Entra ID tenant | One filter statement set: Attribute = Tag (Direct) Operator = Equals Filter 1 = At Risk |
42-
| Service Account Activity | All activity by service accounts | One filter statement set: - Attribute = Tag (Direct) - Operator = Equals - Filter = Service Account |
43-
| Watchlist User Activity | All activity by watchlist users | One filter statement set: - Attribute = Tag (Effective) - Operator = Equals - Filter = Watchlist |
44-
45-
You can save additional investigations to this folder.
30+
| Investigation | Description | Filters |
31+
| --- | --- | --- |
32+
| AD Changes | All Active Directory changes | One filter statement set: <br /><ul><li>Attribute = Event Operation</li><li>Operator = Equals</li><li>Filter = Active Directory Change</li></ul> |
33+
| AD Changes by Domain Admins | All Active Directory changes by Domain Admin>s | Two filter statements set: <br /><ul><li> Attribute 1 = Event Operation</li><li>Operator 1 = Equals</li><li>Filter 1 = Active Directory Change</li></ul><p>AND</p><ul><li>Attribute 2 = Tag (Effective)</li><li>Operator 2 = Equals</li><li>Filter 2 = Domain Admin</li></ul> |
34+
| AD Logins | Active Directory logins including Kerberos and NTLM authentication | One filter statement set: <br /><ul><li> Attribute = Event Operation</li><li>Operator = Equals</li><li>Filter = Active Directory Authentication</li></ul> |
35+
| All Events | New Investigation | No filters set |
36+
| Confirmed Compromised Account Activity | Occurs when a Confirmed Compromised Account is being active within an Entra ID tenant | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter 1 = Confirmed Compromised</li></ul> |
37+
| Failed AD Logins | All failed Active Directory logins including Kerberos and NTLM authentication | Two filter statements set: <br /><ul><li>Attribute 1 = Event Operation</li><li>Operator 1 = Equals</li><li>Filter 1 = Active Directory Authentication</li></ul><p>AND</p><ul><li>Attribute 2 = Success</li><li>Operator 2 = Equals</li><li>Filter 2 = false</li></ul> |
38+
| Failed Entra ID Logins | Occurs when an Entra ID login attempt has failed | Two filter statements set: <br /><ul><li>Attribute = Event Operation</li><li>Operator = Equals</li><li>Filter 1 = EntraID Sign-In</li></ul><p>AND</p><ul><li> Attribute = Success</li><li>Operator = Equals</li><li>Filter 2 = False</li></ul> |
39+
| LDAP Search | All LDAP search events | One filter statement set: <br /><ul><li>Attribute = Event Operation</li><li> Operator = Equals</li><li>Filter = LDAP Search</li></ul> |
40+
| Privileged Account Activity | All activity by privileged accounts | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter = Privileged</li></ul> |
41+
| Risky User Activity | Occurs when a Risky User is being active within an Entra ID tenant | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter 1 = At Risk</li></ul> |
42+
| Service Account Activity | All activity by service accounts | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter = Service Account</li></ul> |
43+
| Watchlist User Activity | All activity by watchlist users | One filter statement set: <br /><ul><li>Attribute = Tag (Effective)</li><li>Operator = Equals</li><li>Filter = Watchlist</li></ul> |
44+
45+
You can save additional investigations to this folder.

‎docs/threatmanager/3.0/administration/investigations/favorites.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,14 @@ pane. Click the investigation there to open it.
3030

3131
There is an empty star icon beside the name of an investigation not identified as a favorite.
3232

33-
![Empty star showing that investigation is not a favorite](/img/product_docs/threatprevention/7.5/reportingmodule/investigations/favoriteselectedtm.webp)
33+
![Empty star showing that investigation is not a favorite](/img/product_docs/threatmanager/3.0/administration/investigations/FavoriteUnselectedTM.webp)
3434

3535
Click the star to add the investigation to your Favorites list.
3636

3737
## Remove an Investigation from Your Favorites
3838

3939
There is a yellow star icon beside the name of an investigation identified as a favorite.
4040

41-
![Favorite investigation star icon selected](/img/product_docs/threatprevention/7.5/reportingmodule/investigations/favoriteselectedtm.webp)
41+
![Favorite investigation star icon selected](/img/product_docs/threatmanager/3.0/administration/investigations/FavoriteSelected.webp)
4242

4343
Click the yellow star to remove the investigation from your Favorites list.

0 commit comments

Comments
 (0)