View Active Directory Alerts

This section provides details on identifying, assessing, and responding to alerts in your Active Directory infrastructure. These are the alerts are based on configured Rules.

The Alerts provide comprehensive visibility into security threats and anomalous activities detected in your identity systems. This application identifies suspicious patterns, unauthorized access attempts, and malicious behaviors, enabling you to respond rapidly to potential security incidents and maintain a secure environment.

Prerequisite: Availability of AD Real-Time Monitoring is dependent on Qualys Cloud Agent version 6.6.0+

What is an Alert?

An alert is a security notification triggered by detected anomalies or suspicious activities within your Active Directory environment. Each alert in this module represents:

• Detected threat indicators, including attack techniques and lateral movement patterns
• Suspicious authentication activities such as Pass-the-Hash or Kerberos attacks
• Privilege escalation attempts and unauthorized access incidents
• Severity assessment based on threat potential and business impact
• Detailed remediation guidance to contain and resolve the threat

Unlike events, which are raw directory activities, alerts are intelligence-driven notifications that combine multiple data sources and threat analysis to identify genuine security risks requiring immediate action.

Alert Severity Levels

Each alert is assigned a Severity Level that reflects the threat potential and business impact. Severity levels are categorized as follows:

For example,
CRITICAL	Possible system compromise detected	Immediate response required - isolate systems, investigate source
HIGH	Strong indicators of compromise or unauthorized access	Urgent investigation required within hours
MEDIUM	Moderate risk with potential for escalation	Review and investigate within one business day
LOW	Minor anomalies or informational indicators	Monitor and investigate as part of regular reviews

Alert Risk Factors

Beyond severity levels, alerts are assessed using additional context that influences threat prioritization:

• Attack Complexity: How sophisticated or easily executable is the attack technique detected
• Privileges Required: What level of access is needed to execute the detected attack
• Exploitability: How readily available are tools and techniques for this attack method
• Impact Scope: How many systems or users could be affected by a successful exploitation
   

Alerts Findings

To view the alerts detected on your monitored systems, navigate to the Monitoring > Alerts page. You can use various filters, grouping options, and search capabilities to identify and prioritize threats.

The Alerts listing page highlights the following key elements:

1. Total Alerts Counter: Displays the total number of alerts currently available (For example, 4.7K alerts). This counter updates in real-time as new alerts are generated.
2. Search Bar: Allows you to search for specific alerts using tokens based on event IDs, domains, categories, host names, and many more.
3. Group By Option: Helps you organize events by Actor Username, Target Username, Host Severity, and many more. Click any value in the results to drill down and view related alerts.
4. Quick Filters: Located in the left sidebar, these provide rapid filtering by Severity (Medium, High, Critical), Category and Domain. These filters help focus on the most critical threats.
5. Pagination Controls: Navigate through pages of alerts to focus on specified detections.

 The Alerts table displays the following columns:

• Alert: The name of the detected threat or suspicious activity (For example, 'Pass-the-Hash NTLM Lateral Movement'). Click to view full details.
• Timestamp: The date and time when the alert was triggered (For example, 'a few seconds ago').
• Severity: The threat level badge (Critical, High, Medium, Low) indicates the urgency and potential impact.
• Host: The computer or domain where the alert was triggered (For example, Win2019.CopyEditor corp.sigma.com).

View Alert Details

Click any alert in the listing to open the Alert Details panel. The details are organized into five tabs that provide comprehensive information for investigation and response.

Overview Tab

The Overview tab provides the executive summary of the alert:

• Alert Header: Displays the alert name, severity badge, and indicates patch availability status
• Alert Description: Provides a brief explanation of the threat and what was detected
• Event Information: Lists the underlying event ID, event description, and logon ID
• Process Details: Shows the process name (for example, lsass.exe) and time created

Source Tab

The Source tab provides the following source details:

• Subject User SID: Unique security identifier assigned to the user account involved in the activity.
• Subject Domain Name: Domain to which the user account belongs.
• Subject User Name: Username of the account that initiated or was associated with the event.
• Subject User Description: Descriptive information configured for the user account, providing additional identity context.

Target Tab

The Target tab identifies what resource or account was targeted by the attack:

• Target User SID: The security identifier of the user account targeted by the attack
• Target Domain Name: The domain containing the targeted resource
• Target User Name: The name of the compromised or targeted user account
• Is Enabled: The account status.
• Is Critical System Object: Active Directory protection indicator.
• Admin Count: Value of the AD
• Member Of: Group memberships
• Password Last Set: Timestamp of the last password change

Remediation Steps

The Remediation Steps tab provides actionable guidance to contain and resolve the threat:

Step 1: Immediate containment actions, such as deactivating compromised accounts or revoking sessions

Step 2: Security configuration changes, such as group policy modifications or access restrictions

Step 3: Network hardening actions, such as blocking SMB traffic or rotating credentials

Step 4: Forensic and incident response procedures, including evidence collection and notifications

Raw JSON Tab

The Raw JSON tab displays the complete alert data in JSON format, useful for:

Advanced Analysis: Technical teams can access all alert properties and metadata

SIEM Integration: Export alert data to security information and event management systems

Automation: Use the structured data in scripts and automated incident response workflows

Archival and Compliance: Store alerts in standard format for audits and investigations

Alert Investigation Workflow

When responding to alerts, follow this systematic workflow:

• Filter by Severity: Immediately prioritize Critical and High severity alerts
• Review Alert Details: Examine the Overview tab to understand the threat and impact
• Identify Source and Target: Use Source and Target tabs to understand attack direction
• Follow Remediation Steps: Execute the recommended actions in the order specified
• Document Actions: Record all containment and remediation steps performed
• Verify Containment: Confirm that the threat has been successfully contained
• Post-Incident Review: Analyze logs and implement preventive measures.