Configuring Active Directory Connectors

This connector allows Stellar Cyber to ingest logs from Active Directory (AD) and add the records to the data lake and, optionally, to issue the Disable User response action.

Active Directory integration with Stellar Cyber enables organizations to monitor and detect security threats across their network, including domain controllers, workstations, and servers, while providing quick case response capabilities.

We recommend that you configure an Active Directory connector. It provides the following key capabilities:

• The user information from AD enriches event Interflow records and provides user profile details for User Behavior Analytics.

• The computer information from AD supports Windows Event Collector (WEC), which lets one server forward the Windows Event logs belonging to several Windows machines.

• Stellar Cyber can be configured to use this connector to disable AD users that have been identified as a security risk.

Stellar Cyber connectors with the Collect function (collectors) may skip collecting some data when the ingestion volume is large, which potentially can lead to data loss. This can happen when the processing capacity of the collector is exceeded.

Connector Overview: Active Directory

               Let us know if you find the above overview useful.

Adding an Active Directory Connector

To add an Active Directory connector:

1. Obtain and verify Active Directory requirements
2. Add the connector in Stellar Cyber
3. Test the connector
4. Verify ingestion

Obtaining and Verifying Active Directory Requirements

To configure an Active Directory Stellar Cyber connector, you will need the following information:

• The Active Directory domain to be monitored

• The fully qualified domain name (FQDN) or IP address for an Active Directory Server configured as a Domain Controller

• The protocol type (LDAP, LDAPS, or LDAPS with certificate validation disabled)

• (Optional) To support authentication using Kerberos, you will need an AD Server with Kerberos enabled and you will also need a Kerberos server.

• Active Directory username and passwords with appropriate permissions 

• For the Active Directory collector running on Sensor, you need to add the AD server to the Sensor DNS

The permissions for the Stellar Cyber Active Directory Respond function are greater than for the Collect function. You may, optionally, set up two different connector instances for different purposes, if you want to different user accounts for the Stellar Cyber collection and response purposes.

• For Collect only configurations, the username and password needs to be a standard Active Directory user who is a member of the domain to be monitored.

  The password should not include non-ASCII special characters.

  

• For Respond configurations, follow the steps below to ensure the account is configured appropriately.

  1. Launch Active Directory Users and Computers with administrative credentials.

  2. Right click on the Organizational Unit with the user account for which you want to enable the respond action authority, and select Delegate Control.

     

  3. Select the user or group to which you want to delegate the authority, then press Next.

     

  4. Select Create Custom Task to Delegate and press Next.

     

  5. In the Delegation of Control Wizard, select the radio button for Only the following objects in the folder.

     

  6. Check the box for User objects, then press Next.

  7. In the Permissions panel section for Show these permissions, uncheck General and check Property-specific.

     

  8. In the specific permissions section, check the boxes for Read userAccountControl and Write userAccountControl.

  9. Click Next, and then Finish.

Adding the Connector in Stellar Cyber

To add an Active Directory connector in Stellar Cyber:

1. Log in to Stellar Cyber.

2. Click System | Integration | Connectors. The Connector Overview appears.

   

3. Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

   

   The asterisk (*) indicates a required field.

4. Choose IdP from the Category drop-down.

5. Choose Active Directory from the Type drop-down.

6. For Function, enable Collect. If you want to be able to disable users, also check the box for Respond.

7. Enter a Name.

   Notes:

   • This field does not accept multibyte characters.
   • It is recommended that you follow a naming convention such as tenantname-connectortype.

8. Choose a Tenant Name. The Interflow records created by this connector include this tenant name.

9. Choose the device on which to run the connector.

10. (Optional) When the Function is Collect, you can apply Log Filters. For information, see Managing Log Filters.

11. Click Next. The Configuration tab appears.

    

    The asterisk (*) indicates a required field.

12. Enter the Active Directory Domain to be monitored, for example, QATEST01.COM.

13. Enter the Server Hostname, which is the fully qualified domain name (FQDN) or IP address for an Active Directory Server configured as a Domain Controller.

    Do not include https in the hostname.

14. Enter the Interval (min). This is how often the logs are collected.

15. Enter the User Name for AD authentication. See the above section for guidance on permissions for the user account required to collect and respond.

16. Enter the Password.

17. Choose the applicable Protocol Type: LDAP, LDAPS, LDAPS (certificate validation disabled), or Kerberos.

    You can only configure one Active Directory connector with Kerberos on each Sensor.

    If you enable channel rebinding, you must select Kerberos for the Protocol Type. By default, NTLM is used, but if you enable channel rebinding, you must enable Kerberos.

18. (Optional) If you selected Kerberos, the following configuration tab has more fields:

    

    The asterisk (*) indicates a required field.

    1. Enter the Realm Name. This is your Kerberos realm, in uppercase, for example, STELLAR.LOCAL.

    2. Enter the KDC. This is the name or address of a host running a Key Distribution Center (KDC) for that realm.

    3. Enter the Admin Server. This is the host where the administration server is running. Typically, this is the master Kerberos server.

    4. Enter the Default Domain. This is the Kerberos realm name for a particular host or domain.

19. (Optional) Choose the Content Type. The logs for Computers are supported.

    Stellar Cyber queries computers using LDAP, enriches them with IP address information through DNS, and populates the Windows Events index.

    In addition, the computers are sent to the Investigate | Asset Analytics page.

20. Click Next. The final confirmation tab appears.

    

21. Click Submit.

    To pull data, a connector must be added to a Data Analyzer profile if it is running on the Data Processor.

The new connector is immediately active and collects up to 90 days of activity stored in the AD server.

Testing the Connector

If you're running the Active Directory connector on a Sensor, make sure that the Sensor and DP are running the same version of software. Otherwise the test might not work.

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates only the authentication / connectivity; it does not validate data flow).

For connectors running on a sensor, Stellar Cyber recommends that you allow 30-60 seconds for new or modified configuration details to be propagated to the sensor before performing a test.

1. Click System | Integrations | Connectors. The Connector Overview appears.

   

2. Locate the connector that you added, or modified, or that you want to test.

3. Click Test at the right side of that row. The test runs immediately.

   Note that you may run only one test at a time.

Verifying Ingestion

To verify ingestion:

1. Click Investigate | Threat Hunting. The Interflow Search tab appears.
2. Change the Indices to Windows Events. The table immediately updates to show ingested Interflow records.