Active Directory Audit and Monitoring

The entire cybersecurity framework is based on three things: protect, detect, and respond. All these components are connected to one another. When we implement a system, we first need to understand what to protect and how to protect it. So far in this book, I've explained the importance of an identity infrastructure and how to protect it from emerging threats. Based on that, we can build a protected identity infrastructure, but we should understand that we cannot close all the doors. We need to expect a possible security breach at any time. But when it happens, we should have a system in place to detect and notify. This allows us to respond to the situation quickly and to minimize damage. In order to detect similar incidents, it is important to have proper systems and processes in place. This is where audit and monitoring come in. These...