User Auditor

The User Auditor keeps an inventory of the user accounts that appear in your logs: Windows (Active Directory) accounts, Linux accounts and cloud accounts from Office 365, Azure, Google Cloud and AWS. For each account it records when it was created, when it last signed in and when it was deleted, so you can spot unknown, stale or removed accounts. You can also group the accounts of one person into an identity.

How the inventory is built

There is nothing to set up. UTMStack builds the inventory from logs that already arrive from your data sources. It reads every event of these data types as it is processed: Windows event logs, Linux, Office 365 (management API and Microsoft Graph), Azure, Google Cloud and AWS. It raises no alerts.

Changes are saved every 60 seconds, and the inventory survives restarts. Accounts are kept per tenant.

Open the User Auditor

Go to User Auditor in the side menu.

The identity controls are shown only to users with adaudit.write. You see the accounts of your own tenant. An instance operator who can see several tenants gets a tenant menu with All tenants.

The page

• Account inventory: how many accounts are active, disabled and deleted, how many were seen in the last 24 hours, the accounts By domain, and how many are grouped into identities or unassigned.

• Views: All accounts, Windows, Linux, O365, Azure, GCP and AWS.

• Search by account name or SID…

• Add filter with Lifecycle status is Active, Disabled or Deleted.

• An identity menu: All identities, No identity (accounts not grouped yet) or one identity by name.

• Refresh, and a choice of List or Cards layout.

The list loads 50 accounts at a time.

The list shows Account, Account ID (the SID for Windows, the user ID and host for Linux, the user name for cloud accounts), Identity, Status, Last logon, Last seen and Tenant.

Status and badges

Account details

Click an account to see its details: Account name, Domain, Hostname, SID, UID, Machine ID, Tenant, AD status, and its Lifecycle (Account created, Last logon, Last seen in logs, Account deleted).

• Copy SID copies the account's SID.

• View events in Log Explorer opens Log Explorer on the last 30 days of events for this account: for Windows, the create, delete and logon events of its SID; for Linux and cloud accounts, the events of its user name (and host, for Linux).

Group accounts into identities

One person often has several accounts: a Windows account, a Linux login and a cloud account. An identity groups them so you can see them together.

1. Open an account and use Add identity.

2. Pick an existing group (Search groups…), or type a name under New group (2 to 64 characters, unique in your tenant) and click Create & assign.

3. To take the account out again, use Remove from group.

You can also Rename identity and Delete identity. An identity that still has accounts cannot be deleted: remove its accounts from the group first.

Common tasks

Review stale accounts

Accounts nobody uses are an easy way in for an attacker.

1. Open User Auditor and choose a view, for example Windows.

2. Add filter > Lifecycle status is Active.

3. Look for the stale badge: active accounts whose last logon is more than 30 days ago.

4. For each one, check with its owner whether it is still needed, and disable or delete it in the source system (Active Directory, the Linux host, the cloud console). UTMStack only observes accounts; it cannot change them.

The next deletion event that reaches UTMStack moves the account to Deleted.

Check new and deleted accounts

1. Open an account and read its Lifecycle: Account created, Last logon, Last seen in logs and Account deleted.

2. An account created and deleted within a short time, or a new account nobody asked for, is worth an investigation. Click View events in Log Explorer to see the events that created it, then check who did it.

Investigate an account named in an alert

1. Copy the user name from the alert's Parties tab.

2. In User Auditor, type it in Search by account name or SID….

3. Check its status, last logon and identity. A service account or an account with the stale badge that suddenly logs on deserves attention.

4. Click View events in Log Explorer for its recent activity, or use the user recipes in Log Explorer Query Cookbook.

Group the accounts of one person

When the same person has a Windows account, a Linux login and a Microsoft 365 account, group them into an identity (see Group accounts into identities above). Then pick the identity in the identity menu to see all the person's accounts together, for example when the person leaves the company and every account must be removed.

Check that the inventory fills

1. 1

   Make sure the right events are sent

   The inventory only sees what your logs contain:

   • Windows: logon events (4624) and account management events (4720, 4726) must be audited. The UTMStack Windows agent turns this auditing on when it installs; a Group Policy can override it. See Windows Agent.

   • Linux: the agent must collect the system journal, and the server must write the audit log for logins. See Linux Agent.

   • Cloud: the integration must be connected and sending. See Microsoft 365 (Office 365 Management Activity API), Microsoft 365 through Microsoft Graph, Microsoft Azure, Google Cloud and AWS CloudWatch.

2. 2

   Produce an event

   Sign in to a monitored Windows host or Linux server with a test account, or create a test account.

3. 3

   Wait and look

   After a minute or two, search the account name in User Auditor. Its Last logon or Account created should show the time of your test. If it does not, find the event in Log Explorer first: if the event is not there, the problem is collection, not the User Auditor.

Troubleshooting