Carbon Black Cloud Enterprise EDR features Identity Intelligence. Identity Intelligence provides visibility into authentication events that occur on Windows endpoints (supported by Carbon Black Cloud Windows Sensor 3.9.1+ running on Windows 10.0.15063+).

Note: The Processes and Auth Events tabs are available for Carbon Black Cloud Enterprise EDR customers only.

Identity Intelligence improves the visibility that Carbon Black Cloud Enterprise EDR provides into user authentication activity. This type of endpoint telemetry is essential for identifying anomalies and threats.

With Identity Intelligence, Carbon Black Cloud Enterprise EDR collects various types of Windows authentication events, which are reported in the Auth Events tab on the Investigate page.

The reporting of Windows authentication events supplements the reporting of process events, which enables the correlation of authentication and process activity, and yields more context-rich threat hunting, investigations, and incident response.

Authentication event data provides insight into the following events (and more):

  • Attackers’ authentication-based tactics, techniques, and procedures (TTPs)
  • Who was logged in to an endpoint when process activity of interest occurred
  • Who attempted but failed to login to an endpoint
  • Brute-force attacks
  • Attempted logins outside of expected hours
  • Remote authentication attempts from anomalous or suspicious sources
  • Privilege escalation attempts
  • Account changes
  • Use of stolen credentials
  • Lateral movement between endpoints
  • Insider threat behavior

Some of the benefits Security Operations Center (SOC) Analysts gain from the reporting of authentication events include:

  • Increased visibility into endpoint activity
  • Additional context during threat hunting and incident response
  • Increased potential for correlation of authentication and process events
  • Reduced mean time to respond (MTTR)
  • Consolidation: reduced reliance on third-party solutions for the collection of authentication events
Tip:
  • You can also use the Auth Events API to gain visibility into authentication events that occur on Windows endpoints.
  • You can also use the Auth Events forwarder to send all your organization's Auth Events to an external SIEM, security lake, or custom integration for further analysis. See Add a Data Forwarder.