Identity Security Insights 24.08 release notes
August 6, 2024
Enhanced Features
Webhook Integrations
Previously a single tile, there are now numerous third-party webhook integrations shown, which include improved documentation (documentation for IBM QRadar to be released soon).
GitHub Connector - Upgraded with New Permissions
We have updated the GitHub Connector with four new permissions.
Repository permissions
- Secret scanning alerts
Organization permissions
- Organization codespaces secrets
- Organization dependabot secrets
- Secrets
Azure Connector - Removed License Warnings
We have discontinued displaying warning messages related to Azure licenses for configured connectors where the environment does not have the required licenses. This change aims to reduce alert fatigue and ensure warnings are relevant.
Enhanced Connectivity Status in Connectors
Connectors now display aggregated connectivity status for both event and inventory activities. Previously, status fluctuations could occur due to separate job outcomes (e.g., inventory vs. event jobs). This update ensures that the connectivity status remains in a warning state until all underlying issues are resolved.
Optimized Accounts and Entitlements Grids
To improve performance and responsiveness, we’ve optimized the Accounts and Entitlements grids to display only the top 1,000 results. This enhancement ensures quicker load times and a smoother user experience.
Recommendations - Entra
Entra Directory Synchronization role assigned
Ensure the Directory Sync Account Role is only assigned to the legitimate Sync Account for secure Entra and AD synchronization.
Excessive Entra access token lifetime policy
Ensure token lifetime policies are configured to mitigate security risks by reducing the default values provided by Microsoft Entra.
Entra Conditional Access Policy long persistent browser sessions
Ensure that persistent browser sessions configurations are set to one day or less to reduce the risk of unauthorized access following successful sign-ins.
Entra Conditional Access Policy persistent browser sessions to sensitive apps
Configure persistent browser session to sensitive Microsoft 365 applications to 12 hours or less using Conditional Access.
Detections - Entra
Anomalous Entra Synchronization account behavior
Identify and investigate unusual sign-in activities by the sync account to safeguard against unauthorized access or privilege escalation between Microsoft Entra and Active Directory.
Detections - AD
Detection - DCSync attack using MSOL account
Investigate suspicious sign in events and activity by the MSOL account to detect unauthorized access and potential credential dumping between Active Directory and Entra environments.
Coming Soon
These features will appear in the recommendations grid, however they will become functional after an upcoming release of a new version of the Insights Collector.
Enhanced Password Security Recommendations for Active Directory
Blank Passwords
Soon, we’ll introduce a to help you identify accounts with no set passwords.
Compromised Passwords
We are developing a feature that will alert you if any account password appears on known compromised lists, allowing you to take immediate action to secure affected accounts.
Collision (Shared) Passwords
Look forward to a recommendation that identifies accounts sharing the same password within your organization that highlights potential risks.