Configuring Active Directory Connectors

This connector allows Stellar Cyber to ingest logs from Active Directory (AD) and add the records to the data lake and, optionally, to issue the Disable User response action.

Active Directory integration with Stellar Cyber enables organizations to monitor and detect security threats across their network, including domain controllers, workstations, and servers, while providing quick case response capabilities.

We recommend that you configure an Active Directory connector. It provides the following key capabilities:

• The user information from AD enriches event Interflow records and provides user profile details for User Behavior Analytics.

• The computer information from AD supports Windows Event Collector (WEC), which lets one server forward the Windows Event logs belonging to several Windows machines.

• Stellar Cyber can be configured to use this connector to disable AD users that have been identified as a security risk.

Stellar Cyber connectors with the Collect function (collectors) may skip collecting some data when the ingestion volume is large, which potentially can lead to data loss. This can happen when the processing capacity of the collector is exceeded.

Connector Overview: Active Directory

Adding an Active Directory Connector

To add an Active Directory connector:

1. Obtain and verify Active Directory requirements
2. Add the connector in Stellar Cyber
3. Test the connector
4. Verify ingestion

Obtaining and Verifying Active Directory Requirements

To configure an Active Directory Stellar Cyber connector, you will need the following information:

• The Active Directory domain to be monitored

• The fully qualified domain name (FQDN) or IP address for an Active Directory Server configured as a Domain Controller

• The protocol type (LDAP, LDAPS, or LDAPS with certificate validation disabled)

• (Optional) To support authentication using Kerberos, you will need an AD Server with Kerberos enabled and you will also need a Kerberos server.

• Active Directory username and passwords with appropriate permissions 

• For the Active Directory collector running on Sensor, you need to add the AD server to the Sensor DNS

The permissions for the Stellar Cyber Active Directory Respond function are greater than for the Collect function. You may, optionally, set up two different connector instances for different purposes, if you want to different user accounts for the Stellar Cyber collection and response purposes.

• For Collect only configurations, the username and password needs to be a standard Active Directory user who is a member of the domain to be monitored.

  The password should not include non-ASCII special characters.

  

• For Respond configurations, follow the steps below to ensure the account is configured appropriately.

  1. Launch Active Directory Users and Computers with administrative credentials.

  2. Right click on the Organizational Unit with the user account for which you want to enable the respond action authority, and select Delegate Control.

     

  3. Select the user or group to which you want to delegate the authority, then press Next.

     

  4. Select Create Custom Task to Delegate and press Next.

     

  5. In the Delegation of Control Wizard, select the radio button for Only the following objects in the folder.

     

  6. Check the box for User objects, then press Next.

  7. In the Permissions panel section for Show these permissions, uncheck General and check Property-specific.

     

  8. In the specific permissions section, check the boxes for Read userAccountControl and Write userAccountControl.

  9. Click Next, and then Finish.

Adding the Connector in Stellar Cyber

To add an Active Directory connector in Stellar Cyber:

1. Log in to Stellar Cyber.

2. Click System | Connectors (under Integrations). The Connector Overview appears.

   

3. Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

   

   The asterisk (*) indicates a required field.

4. Choose IdP from the Category drop-down.

5. Choose Active Directory from the Type drop-down.

6. For Function, enable Collect. If you want to be able to disable users, also check the box for Respond.

7. Enter a Name.

   Notes:

   • This field does not accept multibyte characters.
   • It is recommended that you follow a naming convention such as tenantname-connectortype.

8. Choose a Tenant Name. The Interflow records created by this connector include this tenant name.

9. Choose the device on which to run the connector.

   • Certain connectors can be run on either a Sensor or a Data Processor. The available devices are displayed in the Run On menu. If you want to associate your collector with a sensor, you must have configured that sensor prior to configuring the connector or you will not be able to select it during initial configuration. If you select Data Processor, you will need to associate the connector with a Data Analyzer profile as a separate step. That step is not required for a sensor, which is configured with only one possible profile.

   • If the device you're connecting to is on premises, we recommend you run on the local sensor. If you're connecting to a cloud service, we recommend you run on the DP.

10. (Optional) When the Function is Collect, you can apply Log Filters. For information, see Managing Log Filters.

11. Click Next. The Configuration tab appears.

    

    The asterisk (*) indicates a required field.

12. Enter the Active Directory Domain to be monitored, for example, QATEST01.COM.

13. Enter the Server Hostname, which is the fully qualified domain name (FQDN) or IP address for an Active Directory Server configured as a Domain Controller.

    Do not include https in the hostname.

14. Enter the Interval (min). This is how often the logs are collected.

15. Enter the User Name for AD authentication. See the above section for guidance on permissions for the user account required to collect and respond.

16. Enter the Password.

17. Choose the applicable Protocol Type: LDAP, LDAPS, LDAPS (certificate validation disabled), or Kerberos.

    You can only configure one Active Directory connector with Kerberos on each Sensor.

    If you enable channel rebinding, you must select Kerberos for the Protocol Type. By default, NTLM is used, but if you enable channel rebinding, you must enable Kerberos.

18. (Optional) If you selected Kerberos, the following configuration tab has more fields:

    

    The asterisk (*) indicates a required field.

    1. Enter the Realm Name. This is your Kerberos realm, in uppercase, for example, STELLAR.LOCAL.

    2. Enter the KDC. This is the name or address of a host running a Key Distribution Center (KDC) for that realm.

    3. Enter the Admin Server. This is the host where the administration server is running. Typically, this is the master Kerberos server.

    4. Enter the Default Domain. This is the Kerberos realm name for a particular host or domain.

19. (Optional) Choose the Content Type. The logs for Computers are supported. (The logs for Users are also supported, but they are hard coded and cannot be selected from the user interface.)

    Stellar Cyber queries computers using LDAP, enriches them with IP address information through DNS, and populates the Windows Events index.

    In addition, the computers are sent to the Investigate | Asset Analytics page.

20. Click Next. The final confirmation tab appears.

    

21. Click Submit.

    To pull data, a connector must be added to a Data Analyzer profile if it is running on the Data Processor.

22. If you are adding rather than editing a connector with the Collect function enabled and you specified for it to run on a Data Processor, a dialog box now prompts you to add the connector to the default Data Analyzer profile. Click Cancel to leave it out of the default profile or click OK to add it to the default profile.

    • This prompt only occurs during the initial create connector process when Collect is enabled.

    • Certain connectors can be run on either a Sensor or a Data Processor, and some are best run on one versus the other. In any case, when the connector is run on a Data Processor, that connector must be included in a Data Analyzer profile. If you leave it out of the default profile, you must add it to another profile. You need the Administrator Root scope to add the connector to the Data Analyzer profile. If you do not have privileges to configure Data Analyzer profiles, a dialog displays recommending you ask your administrator to add it for you.

    • The first time you add a Collect connector to a profile, it pulls data immediately and then not again until the scheduled interval has elapsed. If the connector configuration dialog did not offer an option to set a specific interval, it is run every five minutes. Exceptions to this default interval are the Proofpoint on Demand (pulls data every 1 hour) and Azure Event Hub (continuously pulls data) connectors. The intervals for each connector are listed in the Connector Types & Functions topic.

    The Connector Overview appears.

The new connector is immediately active and collects up to 90 days of activity stored in the AD server.

Testing the Connector

If you're running the Active Directory connector on a Sensor, make sure that the Sensor and DP are running the same version of software. Otherwise the test might not work.

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates authentication and connectivity).

1. Click System | Connectors (under Integrations). The Connector Overview appears.

   

2. Locate the connector by name that you added, or modified, or that you want to test.

3. Click Test at the right side of that row. The test runs immediately.

   Note that you may run only one test at a time.

Verifying Ingestion

To verify ingestion:

1. Click Investigate | Threat Hunting. The Interflow Search tab appears.

2. Change the Indices for the type of content you collected:

   • For Computers and Users, change the Indices to Windows Events.

   • For Computers only, change the Indices to Assets.

   The table immediately updates to show ingested Interflow records.