Best Practices Folder Templates
The Best Practices folder contains the following templates:
Active Directory Folder
| Template | Description | TAGS |
|---|---|---|
| All AD Changes | Gathers all AD changes. Uses the built-in “Exclude Class” – Classes Collection and “Exclude Attribute” – Attributes Collection to restrict unwanted events. Add classes and attributes which will NOT be monitored to these collections | None |
| All GPO Setting Changes | No customizations required to monitor all GPO setting changes | None |
Exchange Folder
warning
Use caution with all Lockdown/Blocking Templates! Blank filters result in everything being locked down or blocked.
| Template | Description | TAGS |
|---|---|---|
| Non-Owner Logon Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Specify the Exchange Mailboxes and Containers to lockdown. Optionally, add Exchange Perpetrators to be allowed or denied. | None |
File System Folder
| Template | Description | TAGS |
|---|---|---|
| File Owner Changes | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded. | None |
| File System Monitoring | Specify the files and/or folders to be monitored. Optionally, add any AD Perpetrators to be included or excluded. Reads are left out due to the potential high volume of data that could be gathered; recommended only for highly sensitive content. | None |
Object Lockdown Folder
warning
Use caution with all Lockdown/Blocking Templates! Blank filters result in everything being locked down or blocked.
| Template | Description | TAGS |
|---|---|---|
| AD Object Permissions Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “Object Permissions - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the Objects to protect. | None |
| AD Root Object Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “Root Object - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the Objects to protect. | None |
| Critical GPO Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “Critical GPO - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the GPOs to protect. | None |
| DNS Record Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “DNS Records - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, and fill in the built-in collection. | None |
| Group Lockdown of Delete, Move, Rename, and Membership Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “Group Lockdown - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the Groups to protect. | None |
| Group, User, and OU Lockdown of Delete, Move, and Rename Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “Group User OU Object Delete and Move - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the Objects to protect. | None |
| OU Structure Lockdown | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “OU Structure - >Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, fill in the built-in collection, and add the OUs to protect. | None |
| User Lockdown of Delete, Move, Rename, and Modify Events | USE CAUTION WITH ALL LOCKDOWN TEMPLATES Uses the built-in “User Lockdown - Allow Perpetrators” – Lockdown Perpetrators Collection. Change the AD Perpetrator tab to ALLOW instead of BLOCK, and fill in the built-in Allow Lockdown Perpetrator Collection, and add the Users to protect. | None |