Cyber Security: Account Management

Description

The Account Management section monitors the creation, modification, and deletion of user, group, and workstation accounts.

Displayed Data

• statistics on the number of created, modified, and deleted accounts
• trends in account creation, modification, and deletion
• event statistics broken down by user accounts
• event statistics broken down by group accounts
• event statistics broken down by workstation accounts

List of Dashboards

The section includes four dashboards.

Account Management: Overview

Account Management: Users

Account Management: Groups

Account Management: Computers

---

Data Model

The section uses the following fields from data sources. Alias used: sm_cs_iam_indexes.

Categorization Fields

Field Name	Value
event.kind	event
event.category	iam
event.type	creation | deletion | change
event.outcome	success | failure | unknown
event.action	From the original event.
event.code	Windows Security Event code from the original event.

General Purpose Fields

Information System event

Field Name	Value
event.module	Module name.
event.dataset	Dataset name.

User user

Field Name	Value
user.name	Username.
user.domain	User domain.
user.id	User Security Identifier (SID).

Host Information host

Field Name	Value
host.name	Host name.

Account on Which the Action Is Performed target

Field Name	Value
target.name	Username.
target.domain	User domain.
target.id	User Security Identifier (SID).

Other Fields

Field Name	Value
event.original	Original event text.

---

Reference Tables

Below is a table of reference tables used in the section.

Name	Fields	Description
sm_cs_iam_privileged_users_lookup	account.name is_privileged	Lookup for privileged accounts.

---

Example Sources

• Windows Security Log
• Linux Auditd Log