Background

This article covers how CyberQP's Privileged Account Auditing feature works and how to configure email alert recipients for key Active Directory privileged account events.

Pre-requisites

• The CyberQP agent must be installed on an Active Directory server for your customers in CyberQP.

Table of Contents

• Background
• Pre-requisites
• Privileged Security Groups
• Alerted Actions
• Configure Alerts

Privileged Security Groups

CyberQP monitors Active Directory accounts that are members of the following privileged security groups. New account detections, account disables, and account deletions for accounts in these groups trigger email alerts.

Alerted Actions

Alerts are batched and sent hourly. A single summary email is delivered at the top of each hour covering all alert types recorded in the previous hour. The table below shows which events are tracked per source and import status.

The following are examples of each alert type in the summary email.

summary email heading

new privileged account email alert

privileged account deleted email alert

privileged account disabled email alert

Configure Alerts

1. Log in to the CyberQP dashboard at https://admin.getquickpass.com. 

2. Click Alerts in the left-side navigation.

   

   alerts menu in left navigation

3. Click Add Email to Notify in the top right of the screen.

   

   add email to notify button in top right

4. Enter a valid email address and click Save.

   

   email address field with save button

   NOTE: You can add up to 10 email addresses.

   The email address appears at the bottom of the Alerts menu.

   

   added email listed at bottom of alerts menu

5. Enable the toggle next to Privileged Account Auditing.

   

   privileged account auditing toggle enabled

   NOTE: This setting applies to all customers with Active Directory agents installed.

end of article