How Can I Find Logs for Microsoft 365 Admin Center Actions?
I'm trying to figure out if there are logs available for actions taken in the Microsoft 365 Admin Center or any of the other Admin Centers. Specifically, I'm…
auditing
How Are Companies Streamlining SOC2 Access Reviews and Evidence Collection?
I'm currently preparing for a SOC2 audit and I've found the process of reviewing access to be more manual than I anticipated. Right now, my process involves exporting…
Should I Audit Every Laptop in Bulk Shipments or Just Spot Check?
When receiving a large shipment of laptops (like over 100 units), do you typically audit all the serial numbers on the packing slip, or do a percentage spot…
Why Aren't Kerberos Event IDs 201-209 Appearing in My System Log?
I recently updated my Domain Controllers with the latest cumulative updates, and now I'm not seeing any Kerberos-related system event log entries for Event IDs 201-209. However, I…
How Can We Effectively Audit AI Agent Actions?
As AI systems are becoming more capable of handling real tasks—like deploying changes, modifying configurations, triggering workflows, and writing data—many teams face the challenge of understanding exactly what…
What's the Best Way to Handle PCI Compliance for Exchange?
I've got an auditor insisting on PCI compliance for our Exchange system. We're aiming to eliminate any PCI-related data from Exchange, including using Data Loss Prevention (DLP) tools.…
How to Manage High Volume of Security Logs on Domain Controllers?
I've enabled auditing on my Windows Domain Controllers, but now the Security log is getting overwhelmed with Event IDs 5156, 5157, and 5158, logging about 50 events per…
What Evidence Do Auditors Accept for Monitoring Practices?
We're currently getting ready for an audit, and one of the requests is to provide proof that monitoring is indeed happening in our systems. We have logs and…
Seeking Tools for Browser Extension Monitoring in SOC 2 Compliance
We're a mid-sized SaaS company with about 80 remote users in development and sales, preparing for our first SOC 2 Type 2 audit coming up in a couple…
How to Pass Switch Parameters in Invoke-Command for Custom Functions?
I'm working on a function for auditing that uses parameter sets with switch parameters like `-Update`, `-Verify`, and `-Revoke`. The function works fine locally and in a PSSession,…
How Do You Manage Admin Accounts for Workstations Without Using Domain Admins?
I'm curious about the practices people follow for workstation, desktop, and laptop Active Directory (AD) administrator usage. Specifically, I'm looking for alternatives to using domain admin accounts for…
What are the Best Cybersecurity Tools for Scanning Docker Images?
I'm searching for an effective agent-based solution to secure my Docker images within a private registry. I've been using Trivy, but it's overwhelming to keep track of all…
Tips Before Disabling NTLMv1
I'm about to disable NTLMv1 across my systems, but I want to make sure everything's ready before I do. Here's my setup: all PCs are on Windows 10…
How Can I Track Successful IAM Auth Connections to MySQL Aurora?
Hey everyone! We've recently set up IAM Authentication for our MySQL Aurora (Serverless v2) instance, but I'm hitting a wall trying to trace successful connection attempts. Currently, the…
Why Are My AD Last Logon Timestamps Inconsistent?
I'm currently auditing inactive Active Directory accounts, and I've run these audits successfully for years. However, in this new environment, I've noticed some discrepancies. In the most recent…
What are some good DNS management solutions for mid-sized companies?
I run a small SaaS company with about 75 employees, and I'm trying to figure out how to better manage the security, auditing, and notifications around my DNS…
How Can I Find Deleted Active Directory Users from the Last 30 Days?
I'm looking to create a CSV report for auditing purposes that shows all Active Directory accounts deleted in the past month. Is there a way to retrieve this…