Configuring audit settings for work with Kaspersky Managed Detection and Response

Expand all | Collapse all

We recommend configuring the following audit settings to ensure stable operation and maximize efficiency of Kaspersky Managed Detection and Response:

• Configuring Windows Event Audit Policy

  To maximize efficiency of Kaspersky Managed Detection and Response, you need to configure Windows Event Audit Policy on your assets.

  To configure Windows Event Audit Policy:

  1. On your assets running Windows, press Win+R to open the Run window.
  2. In the Open field, type gpedit.msc, and then press Enter or click OK. The Local Group Policy Editor window appears.
  3. In the console tree, click Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies - Local Group Policy Object.
  4. Click the Account Logon node. Set the following values in the right side of the window:

     Subcategory	Audit Events
     Audit Credential Validation	Success and Failure
     Audit Kerberos Authentication Service	Success and Failure
     Audit Kerberos Service Ticket Operations	Success and Failure

  5. Click the Account Management node. Set the following values in the right side of the window:

     Subcategory	Audit Events
     Audit Computer Account Management	Success and Failure
     Audit Security Group Management	Success
     Audit User Account Management	Success and Failure

  6. Click the DS access node. Set the following values in the right side of the window:

     Subcategory	Audit Events
     Audit Directory Service Access	Success and Failure
     Audit Directory Service Changes	Success and Failure

  7. Click the Logon/Logoff node. Set the following values in the right side of the window:

     Subcategory	Audit Events
     Audit Account Lockout	Failure
     Audit Logon	Success and Failure
     Audit Special Logon	Success and Failure

  8. Click the Object Access node. Set the following values in the right side of the window:

     Subcategory	Audit Events
     Audit Certification Services	Success and Failure
     Audit File Share	Success
     Audit Filtering Platform Connection	Success
     Audit Other Object Access Events	Success

  9. Click the Policy Change node. Set the following values in the right side of the window:

     Subcategory	Audit Events
     Audit Policy Change	Success
     Audit MPSSVC Rule-Level Policy Change	Success

  10. Click the Privilege Use node. Set the following value in the right side of the window:

      Subcategory	Audit Events
      Audit Sensitive Privilege Use	Success

  11. Click the System node. Set the following values in the right side of the window:

      Subcategory	Audit Events
      Audit Security State Change	Success
      Audit Security System Extension	Success

  12. In the console tree, click the Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell. Set the following value in the right side of the window:

      Subcategory	Audit Events
      Turn on PowerShell Script Block Logging	Enabled

  13. Close the Local Group Policy Editor window.

      All changes are saved automatically.

  The Windows Event Audit Policy is now configured for use with Kaspersky Managed Detection and Response.

• Configuring Audit for Active Directory objects

  To maximize efficiency of Kaspersky Managed Detection and Response, you need to configure audit on your Windows Domain controllers.

  To configure audit for Active Directory objects:

  1. On your Windows Domain controller, press Win+R to open the Run window.
  2. In the Open field, type dsa.msc, and then press Enter or click OK. The Active Directory User and Computers window appears.
  3. In the console tree, right-click <your domain name>, and then select Find. The Find Users, Contacts and Groups window appears.
  4. Enter Administrator in the Name field, and then click Find Now.
  5. In the Search results area, right-click Administrator object, and then select the Properties → Security → Advanced - Auditing tab.
  6. Click Add to open the Auditing Entry for Administrator window. Click Select a principal, enter Everyone, click Check Names, and then click OK.
  7. In the Auditing Entry for Administrator window, select the List contents, Read permissions, Modify permissions, Modify owner, Read all properties, and Write all properties checkboxes.
  8. Click OK → Apply → OK buttons.

     The audit for Active Directory object Administrator is now configured to use with Kaspersky Managed Detection and Response.

  9. Perform the same steps for the following default Active Directory objects and for your sensitive domain users and groups, that exist and are enabled in your system:

  • Administrators
  • Allowed RODC Password Replication Group
  • Cert Publishers
  • Cloneable Domain Controllers
  • Denied RODC Password Replication Group
  • DnsAdmins
  • DnsUpdateProxy
  • Domain Admins
  • Domain Computers
  • Domain Controllers
  • Enterprise Admins
  • Enterprise Key Admins
  • Enterprise Read-only Domain Controllers
  • Group Policy Creator Owners
  • Key Admins
  • krbtgt
  • Protected Users
  • RAS and IAS Servers
  • Read-only Domain Controllers
  • Schema Admins

• Configuring audit for Active Directory Certificate Services, certificate templates, and certificate objects

  To maximize efficiency of Kaspersky Managed Detection and Response, you need to configure audit for the Active Directory Certificate Services service, certificate templates, and objects on the hosts with Active Directory Certificate Services (AD CS) enabled.

  To configure audit for the Active Directory Certificate Services service:

  1. Press Win+R to open the Run window.
  2. In the Open field, type in cmd, and then press Enter or click OK. The Command Prompt window appears.
  3. To configure audit settings for Certification Authority, enter the commands below, and then press Enter:

     certutil -setreg CA\AuditFilter 127

     certutil -setreg policy\EditFlags +EDITF_AUDITCERTTEMPLATELOAD

  4. To restart the Certificate Services service, enter the command below, and then press Enter:

     net stop certsvc && net start certsvc

  To configure security auditing for certificate templates:

  1. Press Win+R to open the Run window.
  2. In the Open field, type in adsiedit.msc, and then press Enter or click OK.
  3. Right-click ADSI Edit, and then select Connect to.
  4. In the Connection Point section, select the Configuration value in the Select a Well Known Naming Context field.
  5. Double click Configuration/Schema on the left pane.
  6. Select the CN=Configuration,DC=… → CN=Services → CN=Public Key Services → CN=Certificate Templates folder.
  7. Right-click the CN=Certificate Templates folder, select Properties, and then open the Security tab.
  8. Click the Advanced button, and then select the Auditing tab.
  9. Click the Everyone principal, select the Write all properties, Delete, Modify permissions, Modify owner, All validated writes checkboxes, and then click OK.

  To configure security auditing for NTAuthCertificates object:

  1. In the Open field, type adsiedit.msc, and then press Enter or click OK.
  2. Right-click ADSI Edit, and then select Connect to.
  3. In the Connection Point section, select the Configuration value in the Select a Well Known Naming Context field.
  4. Double click Configuration/Schema on the left pane.
  5. Select the CN=Configuration,DC=… → CN=Services → CN=Public Key Services → CN=NTAuthCertificates folder.
  6. Right-click the CN=NTAuthCertificates folder, select Properties, and then open the Security tab.
  7. Click the Advanced button, and then select the Auditing tab.
  8. Click the Everyone principal, select the Write all properties, Delete, Modify permissions, Modify owner, All validated writes checkboxes, and then click OK.