Account Management

Description

The Identity and Access Management section is designed for monitoring events related to the management of user accounts (AM), groups, and workstations.

Displayed Data

• Statistics on the number of created / modified / deleted AM
• Trends in the number of created / modified / deleted AM
• Event statistics with details on user AM
• Event statistics with details on group AM
• Event statistics with details on workstation AM

List of Dashboards

• Account Management: Overview
• Account Management: Groups
• Account Management: Computers
• Account Management: Users

Data Model

The section uses the following fields from data sources. Alias used: sm_cs_iam_indexes.

Data Model

The section uses the following fields from data sources. Alias used: sm_cs_iam_indexes.

Categorization Fields

Field Name	Value
event.kind	event
event.category	iam
event.type	creation | deletion | change
event.outcome	success | failure | unknown
event.action	From the original event.
event.code	Windows Security Event code from the original event.

General Purpose Fields

Information System event

Field Name	Value
event.module	Module name.
event.dataset	Dataset name.

User user

Field Name	Value
user.name	Username.
user.domain	User domain.
user.id	User Security Identifier (SID).

Host Information host

Field Name	Value
host.name	Host name.

Information about the AM on which the action is performed target

Field Name	Value
target.name	Username.
target.domain	User domain.
target.id	User Security Identifier (SID).

Other Fields

Field Name	Value
event.original	Original event text.

Reference Tables

Below is a table of reference tables used in the section.

Name	Fields	Description
sm_cs_iam_privileged_users_lookup	account.name is_privileged	Reference table for privileged AM values.

Example Sources

• Windows Security Log
• Linux Auditd Log