The Enterprise Security Workshop IAM and SIEM in action

• Identity at the Core: The First Line of Cyber Defense
• Identity Lifecycle with AD360
• Governance in Microsoft 365
• SharePoint Governance Snapshot

• ADAudit Plus: Real-Time Monitoring for IAM Integrity
• ADSelfService Plus: IAM Starts at the User’s Fingertips
• Compliance Reporting and Unified Visibility

• Provision User in AD + M365 (ADManager Plus + M365 Manager Plus)
• Self-Service Enrollment + MFA (ADSelfService Plus)
• Audit Access & Group Changes (ADAudit Plus)
• M365 & SharePoint Oversight (M365 Manager Plus + SharePoint Manager Plus)

Use Case Deep Dive

• Cybersecurity visibility gaps
• Importance of identity-driven security in today’s threat landscape
• Centralized Log Management and Real-time SIEM
• Detecting Anomalies with Behavioral Analytics

• Detecting critical AD changes: GPO, OUs, group membership, privileged accounts
• Hybrid visibility with Azure AD and Microsoft 365 log integration
• Navigating SOX, GDPR, HIPAA with Log360’s built-in compliance templates
• Security of SaaS applications: Exchange Online, SharePoint, OneDrive, Teams

• Configure a correlation rule to detect credential stuffing attempts using event patterns from domain controllers.
• Analyze a user flagged by UEBA with high risk score. Determine cause, behavior deviation, and recommend action
• A user who normally accesses only finance folders is now modifying files in executive folders and logging in after hours.
• An admin group was modified without an approved request, and audit logs must be investigated to find who made the change and when.
• Find a non-admin user accessed sensitive SharePoint files they weren’t assigned to.
• An internal audit is scheduled, and your team must produce a GDPR/SOX-aligned report showing data access, modification, and permission trails.
• A hybrid AD user account is compromised. The attacker has accessed critical files, changed permissions, and attempted lateral movement across on-prem and cloud environments.