CDHY chooses ADAudit Plus to stand against cyber threats

Security challenge

In 2023, CDHY became the victim of a sophisticated ransomware incident. The organization discovered disruptions in its endpoints on December 14 and determined it was under an attack on December 16. CDHY notified the FBI and the Washington State Patrol of the incident.

As the investigation progressed, the organization identified that individuals both within and outside of the immediate CDHY community might have impacted. Personally identifiable information, like name, Social Security number, birth date, and driver's license and state identification card number, was extracted by hackers who demanded a ransom.

From this incident, CDHY understood the reality of today's cyber environment. It needed an auditing solution that could instantly detect incidents, notify in real time, and audit how the incident occurred and the measures taken to mitigate it.

Why ManageEngine ADAudit Plus became CDHY's auditing solution

• Threat detection: The primary reason CDHY chose ADAudit Plus was the solution's Attack Surface Analyzer module. Attack Surface Analyzer offers organizations in-depth insights for 25+ common Active Directory (AD) attacks, including the detection of ransomware attacks. The feature provides curated evidence reports for each attack along with the activities performed using the exploited account. This made the agency prepared not just for threat detection but with conducting root cause analysis and performing comprehensive auditing once an incident occurs.
• Real-time notification: ADAudit Plus offers real-time alerts on incidents and changes made to an AD environment. This feature allowed CDHY to create customized alerts for its environment. Additionally, the feature helped CDHY initiate a prompt response in the event of an attack, such as executing a script to block the malicious user or shut down the compromised endpoint.
• Compliance reporting: ADAudit Plus has in-built reports for major IT compliance mandates like SOX, the PCI DSS, and HIPAA. Admins can export these reports any time and schedule them to be sent to inboxes periodically, making CDHY compliant and audit-ready.

How CDHY customized ADAudit Plus with OnboardPro

CDHY had an ideal solution in ADAudit Plus but wanted an implementation that could solve for its unique business requirements and objectives. That's why CDHY used OnboardPro, ManageEngine's exclusive professional services for IAM and SIEM solutions. Product Expert Bruce implemented the solution just as the agency required, addressing Mark's technical doubts about the Attack Surface Analyzer and alerting feature.

About ADAudit Plus

ADAudit Plus is a real-time Active Directory change auditing solution that features file and folder monitoring, plus access and permission change capabilities. With more than 200 event-specific reports and real-time email alerts, it provides in-depth knowledge about changes made to both the content and configurations of Active Directory, Azure AD, and Windows servers. Additionally, ADAudit Plus provides thorough insights on workstation and file server access (including NetApp and EMC). For more information about ADAudit Plus, visit https://www.manageengine.com/products/active-directory-audit/.

About OnboardPro

OnboardPro is a ManageEngine service that provides solution implementation to clients upon request. This service includes the installation and customized configuration of ManageEngine solutions. It enables clients to seamlessly begin work without worrying about the complexities of product installation, deployment, and use. Every client environment is unique and requires additional support beyond basic installation and standard features. With our onboarding support, clients have the option to engage a team of product experts to manage the installation, implementation, customization, and training based on their business needs. For more information, visit manageengine.com/onboarding/manageengine-onboardpro-iam-and-siem-professional-service.html.