> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/deploy/sentinelone/add-on/identity-security.md).

# Identity Security

Set up Identity Security, SentinelOne's unified identity protection SKU, on your Active Directory. It covers three engines: ISPM (Active Directory posture assessment), ISIDP (real-time protection of Domain Controllers), and IDR (decoys on endpoints). Microsoft Entra ID integration is optional.

All paths below refer to the Singularity Operations Center sidebar (`Policies and settings` is the button at the bottom of the sidebar).

## Prerequisites

* **Licenses**: Endpoint (Core, Control or Complete) + **Identity Security**, on the Account *and* on every Site.
* **Windows agents**: **≥ 25.2.3.437** on DCs, servers and the AD Connector server. Workstations (IDR): ≥ 24.1.5.277.
* **Legacy Identity Agent**: DCs already on Windows agent 25.2: nothing to do. Only if the legacy Identity Agent is still present: uninstall it, then reboot (never alongside the Windows agent).
* **AD Connector server**: a domain member server, see [Choose the AD Connector server](#choose-the-ad-connector-server).
* **AD Connector → DC flows**: 53 · 88 · 389/636 · 445 · 5986 (WinRM HTTPS) · RPC Event Log.
* **Outbound flows**: HTTPS 443 / WebSocket to the S1 console for your region.
* **AD service account**: a read-only standard user, see [Create the AD service account](#create-the-ad-service-account).
* **WinRM HTTPS on every DC**:

```
winrm quickconfig -transport:https     :: WinRM HTTPS (certificate issued to the DC FQDN)
winrm configsddl default               :: Read + Execute for the service account
:: Firewall: allow TCP 5986 + "Remote Event Log Management (RPC / RPC-EPMAP)"
```

## Enable the Identity engine

`Policies and settings` > `Endpoint/Cloud Workload Security` > `Policy` > `Detection Engines`

1. Select the Account scope (or Site for an MSSP) in the scope selector at the top, then enable **Identity Detection & Response**.
2. Keep the default Identity Settings, with the Update interval set to at least 60 min.
3. In `Policies and settings` > `Accounts`, set **Identity Security Posture Mode** to **Full**.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2Fgit-blob-ff47e3c5a07c99859df109907264e4d57060c7b6%2Fs1-identity-security-detection-engines-enabled.png?alt=media" alt=""><figcaption><p>Detection Engines > Identity Detection &#x26; Response.</p></figcaption></figure>

## Connect Active Directory

`Policies and settings` > `Identity Security` > `Active Directory` > `Connect AD`

Examples in this section use a fictitious forest `acme.local`, with the child domain `corp.acme.local` (NetBIOS `CORP`).

### Create the AD service account

ISPM, ISIDP and IDR only need **read access**. A Domain Admin account is unnecessary and not recommended. ISPM remediation scripts are run separately, manually, by a Domain Admin.

<table data-search="false"><thead><tr><th>Requirement</th><th>Why</th></tr></thead><tbody><tr><td>Dedicated <strong>standard</strong> user (e.g. <code>svc-s1-identity</code>)</td><td>Read-only is enough, and ensures traceability</td></tr><tr><td>Long, random password that <strong>never expires</strong></td><td>If the password changes in AD, the connection drops (status <em>Disabled</em>)</td></tr><tr><td>Created in the forest <strong>root domain</strong></td><td>Required to assess the whole forest with Monitor subdomains</td></tr><tr><td>Kerberos <strong>AES 128 and AES 256</strong> checked</td><td>Required for assessment</td></tr><tr><td>Member of <strong>Remote Management Users</strong></td><td>WinRM access to DCs (threats and some exposures)</td></tr><tr><td>Member of <strong>Event Log Readers</strong></td><td>Reads DC Security logs (source IP and user in detections)</td></tr><tr><td>Read on adminSDHolder, KRBTGT, Administrator, Domain / Schema / Enterprise Admins, MicrosoftDNS container</td><td>Otherwise the "Insufficient permissions for AD exposure assessment" exposure is raised</td></tr><tr><td>Read on <code>CN=Deleted Objects</code></td><td>Detects mass account deletion</td></tr></tbody></table>

<details>

<summary>PowerShell example</summary>

To run on a DC or with RSAT, adjusting names as needed:

```powershell
# 1. Create the account
New-ADUser -Name "svc-s1-identity" -SamAccountName "svc-s1-identity" `
  -UserPrincipalName "svc-s1-identity@acme.local" -Path "OU=Service Accounts,DC=acme,DC=local" `
  -AccountPassword (Read-Host -AsSecureString "Password") -Enabled $true `
  -PasswordNeverExpires $true -CannotChangePassword $true `
  -KerberosEncryptionType AES128,AES256

# 2. Built-in groups
Add-ADGroupMember -Identity "Remote Management Users" -Members "svc-s1-identity"
Add-ADGroupMember -Identity "Event Log Readers"       -Members "svc-s1-identity"
```

```
:: 3. Read rights (List Contents + Read Property), inherited
dsacls "DC=acme,DC=local" /I:T /g ACME\svc-s1-identity:LCRP
dsacls "CN=Deleted Objects,DC=acme,DC=local" /takeownership
dsacls "CN=Deleted Objects,DC=acme,DC=local" /I:T /g ACME\svc-s1-identity:LCRP

:: 4. On EVERY DC: WinRM access and Security log read for Network Service
winrm configsddl default                       :: add the account, check Read + Execute
wevtutil gl security                           :: output must contain (A;;0x1;;;S-1-5-20)
wevtutil sl security /ca:"<current SDDL>(A;;0x1;;;S-1-5-20)"
```

</details>

With *Monitor subdomains*, repeat the `dsacls` commands in every domain where default permissions have been restricted.

### Choose the AD Connector server

* Domain **member** server, not a DC. Example: `srv-s1adc01.corp.acme.local`.
* Always on and not network-quarantined, 4 vCPU / 16 GB RAM, Windows agent **≥ 25.2.3.437**.
* It must **resolve via DNS** and reach every declared domain on ports 53, 88, 389/636, 445 and 5985/5986.
* A single forest, even with multiple domains: **one connector** is enough. Isolated forests without trust: one connector per forest.

Quick checks to run from this server:

```powershell
Resolve-DnsName corp.acme.local
Test-NetConnection dc01.corp.acme.local -Port 636     # LDAPS
Test-NetConnection dc01.corp.acme.local -Port 5986    # WinRM HTTPS
```

### Complete the Connect AD wizard

1. **AD Connector**: type at least 3 characters of the hostname (e.g. `srv`), pick the endpoint with a green status, then *Next*. A banner confirms the connection after a few minutes.
2. **Domain**: fill in the fields from the table below, then *Next*. The console runs an LDAP test, and the domain is saved only if the test succeeds.
3. **Decoys**: configure the decoys, see [Decoys](#decoys), then *Finish*.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2Fgit-blob-2948384debcb6e8660f9c15c95d090e84b53cdb7%2Fs1-identity-security-connect-ad-domain-form.png?alt=media" alt=""><figcaption><p>Domain step of the wizard. In this documentation example, LDAP and WinRM HTTP are selected; in production, prefer LDAPS and WinRM HTTPS.</p></figcaption></figure>

<table data-search="false"><thead><tr><th>Field</th><th>What to enter</th><th>Example</th></tr></thead><tbody><tr><td><strong>Site</strong></td><td>At Account scope: the sites that inherit this domain (useful for IDR and ISIDP). "All" does not cover sites created later.</td><td>Paris, Lyon</td></tr><tr><td><strong>Domain name</strong></td><td>The domain's <strong>DNS FQDN</strong>, never the NetBIOS name. To cover the whole forest, enter the root domain.</td><td><code>acme.local</code> or <code>corp.acme.local</code>, not <code>CORP</code></td></tr><tr><td><strong>Monitor subdomains</strong></td><td>Assesses every domain in the forest (same tree and other trees). Without this box, subdomains are discovered but <strong>not assessed</strong>.</td><td>Checked</td></tr><tr><td><strong>Domain Controller FQDN</strong></td><td>The FQDN of <strong>one</strong> DC in the domain, resolvable by the AD Connector. An RODC is accepted. No IP address. Other DCs are discovered automatically (PDC first).</td><td><code>dc01.corp.acme.local</code>, not <code>10.0.0.10</code></td></tr><tr><td><strong>Domain username</strong></td><td>The service account, in UPN, NetBIOS or plain-name format</td><td><code>svc-s1-identity@acme.local</code>, <code>ACME\svc-s1-identity</code>, or <code>svc-s1-identity</code>; not <code>ACME.LOCAL\svc-s1-identity</code></td></tr><tr><td><strong>Domain password</strong></td><td>Enter carefully: a wrong password <strong>locks the account</strong> after repeated attempts</td><td></td></tr><tr><td><strong>Refresh schedule</strong> (day, time, time zone)</td><td>AD data refresh, to schedule during off-peak hours. It does not trigger the ISPM assessment, which stays fixed at Saturday 04:00 UTC.</td><td>Sunday · 02:00 · Europe/Paris</td></tr></tbody></table>

### Protocols and options

<table data-search="false"><thead><tr><th width="140">Option</th><th width="160">Choice</th><th>Prerequisites and consequences</th></tr></thead><tbody><tr><td rowspan="2"><strong>LDAP method</strong></td><td><strong>LDAPS (636)</strong>, recommended</td><td>Encrypts traffic between the connector and the DCs. Requires a <strong>valid server certificate on the DCs</strong> (AD CS or a "Kerberos / Domain Controller Authentication" certificate) and port 636 open. Check: <code>ldp.exe</code>, SSL connection to <code>dc01.corp.acme.local:636</code>.</td></tr><tr><td><strong>LDAP (389)</strong></td><td>Unencrypted channel, reserved for DCs without a certificate or for troubleshooting. The "LDAPS connection failed" error prompts you to retry over LDAP. Fixed ports, not configurable.</td></tr><tr><td rowspan="2"><strong>WinRM method</strong></td><td><strong>HTTPS (5986)</strong>, recommended</td><td>Requires an HTTPS listener on <strong>every DC</strong>, with a certificate whose Subject is the DC FQDN (the LDAPS certificate works), and port 5986 open: <code>winrm quickconfig -transport:https</code>.</td></tr><tr><td><strong>HTTP (5985)</strong></td><td>If DCs have no certificate. Authentication remains Kerberos, but <code>AllowUnencrypted=true</code> is required on both client and service. <strong>Without WinRM on all DCs</strong>, Threat Detection fails and some exposures become <em>Skipped</em>.</td></tr><tr><td><strong>LDAP referral</strong></td><td>Checked if the forest has subdomains</td><td>Follows referrals to subdomains: ISIDP and IDR policies then also apply to child domains, which become visible in Protocol Configuration. The account must be able to query these subdomains. If enabled afterwards, run <em>Refresh AD Data</em>.</td></tr><tr><td><strong>AD Sync</strong></td><td>Checked</td><td>Syncs user and group attributes. Required for Threat Detection, CCP, compromised account scanning and asset inventory. The first sync can take a while.</td></tr><tr><td><strong>Threat Detection</strong></td><td>Checked (requires AD Sync)</td><td>Real-time ISPM threats: password spray, mass lockouts and resets, etc. Relies on a persistent LDAP connection to the PDC and on WinRM. Disabling it deletes the synced objects.</td></tr><tr><td><strong>Access over trust</strong></td><td>Only for another trusted forest</td><td>To assess a domain in another forest using the main forest's account. Two extra fields: <em>Trust domain name</em> and <em>Trust domain controller</em> (FQDN, no IP). <strong>Cannot be edited</strong> afterwards: delete and recreate.</td></tr></tbody></table>

<details>

<summary>Access over trust example</summary>

The `filiale.local` forest trusts `acme.local`. Enter Domain name = `filiale.local`, Username = `svc-s1-identity@acme.local`, Access over trust = checked, Trust domain name = `acme.local`, Trust domain controller = `dc01.acme.local`. The connector must resolve and reach the `filiale.local` DCs.

</details>

### Decoys

IDR uses these decoys.

<table data-search="false"><thead><tr><th>Field</th><th>Advice</th><th>Example</th></tr></thead><tbody><tr><td>Country for name generator</td><td>Country consistent with your users</td><td>France</td></tr><tr><td>Service (SPN) prefix</td><td>The prefix of your real service accounts, if any</td><td><code>svc</code></td></tr><tr><td>Name format</td><td>Same format as your real usernames. Variables: <code>%FN%</code> (first name), <code>%LN%</code> (last name), <code>%FNI%</code> and <code>%LNI%</code> (initials), <code>%#n%</code> (n random digits).</td><td><code>%FNI%.%LN%</code> → <code>j.dupont</code></td></tr><tr><td>Hostname format</td><td>Modeled on your workstation and DC naming</td><td>Custom: <code>PC-</code> + digits</td></tr><tr><td>IP Address format</td><td>Range or CIDR of <strong>more than 250 addresses</strong>, <strong>never used in production</strong> (otherwise false positives)</td><td><code>10.250.0.0/24</code></td></tr></tbody></table>

{% hint style="warning" %}
Decoys can no longer be edited while an active Identity protection policy covers the domain.
{% endhint %}

### After validation

* The domain status changes to **Enabled**. It reverts to *Disabled* if the connector goes down or the account password changes.
* The console runs AD learning, sync, then the ISPM assessment (about 30 min). Multiple domains added at once are processed one after another.
* Default policies are created, **inactive**.
* Each domain can be declared only **once per organization**. After deleting one, wait 120 s before recreating it. After adding a DC, click **Refresh AD Data**, otherwise DCSync false positives appear.

If the domain cannot be saved, see [Troubleshooting](#troubleshooting).

## Review the AD posture (ISPM)

`Policies and settings` > `Identity Security` > `Identity posture settings`

Nothing else to do: the assessment starts as soon as the domain is saved (about 30 min), then runs every Saturday at 04:00 UTC.

1. For an immediate scan: **Scan Now**.
2. To review results: `Misconfigurations` > `Identity`. Address Critical and High exposures first (click the misconfiguration, then `Actions` > `Mitigate` > `Download Script`).

## Protect Domain Controllers (ISIDP)

`Policies and settings` > `Identity Security` > `Identity Policies` (`Identity provider policy` / `Conditional Access policy` tabs)

Two default policies were created when the domain was saved, **inactive and read-only**. Duplicate them:

1. **Conditional Access policy**: duplicate `Default_policy_account_ca`, add an **Attack based** rule covering all attacks with the **Audit** action, then activate it.
2. **Identity provider policy**: duplicate `Default_policy_account_idp` and check the following:
   * All domains are selected and **Apply to Windows servers** is checked.
   * PAC validation stays enabled, unless a PAM or JIT solution is in place. Learning mode: enabled, 4 days.
   * Kerberos, LDAP, SAMR and LSARPC protocols checked. Add-on: *Pin version* at N-1.
   * Recommended: *Compromised credential configuration* enabled (breach databases, no mitigation at first).
   * The CA policy from step 1 is selected.
3. `Actions` > `Activate Policy`. To push immediately: sidebar `Sentinels` > `Endpoints`, select the DCs, then `Actions` > `Agent Actions` > `Push Identity Policy Changes`.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2Fgit-blob-9a8a118214ab166837d7191294e7b3f153795fc2%2Fs1-identity-security-identity-provider-policy.png?alt=media" alt=""><figcaption><p>Identity provider policy: detection and protocols.</p></figcaption></figure>

{% hint style="info" %}
After a few days without false positives, switch attack rules from *Audit* to **Block**.
{% endhint %}

## Deploy decoys on endpoints (IDR)

`Policies and settings` > `Identity Security` > `Identity Policies` > `Identity protection policy`

1. Click **New Identity protection policy**, with the AD PowerShell response set to **Alert**.
2. Add 4 rules: Privileged Administrators, Service Accounts, Domain Controllers, Delegated Admins. Select the real objects, then check **Add Decoys** and **Hide Real Objects**.
3. *Create*, then `Actions` > `Activate Policy`.

Test from a domain workstation: `net group "Domain Admins" /domain` should return a decoy account. With a 25.2.3+ agent, the detection shows up as an indicator in `Event Search` (query: `indicator.name = 'IdentityDeceptivePing'`). Other alerts are in `Alerts`.

## Connect Microsoft Entra ID (optional)

Only if the customer uses Entra ID: `Policies and settings` > `Cloud accounts` > `Microsoft Azure`. You need a tenant **Global Admin** account and the Tenant ID. Optional: the Object ID of a "risky users" group.

1. *Connect account*: type **Tenant**, check **Enable Identity Security**.
2. Connection name, Tenant ID, and **Sync Microsoft Entra ID user accounts** enabled.
3. In Azure: *Tenant Properties* > *Access management for Azure resources = Yes*, then sign out and back in.
4. Download the Terraform template and run it in Azure Cloud Shell:

```
terraform init && terraform apply -auto-approve
```

5. Paste `application_id` and `client_secret`, then **Select All** and automatic onboarding, and *Finish*.

{% hint style="warning" %}
The secret **expires after one year**: plan its renewal.
{% endhint %}

Results appear in `Misconfigurations` > `Identity`.

## Verify that an alert is raised

From a domain-joined workstation, with a domain account, preferably in a pilot.

1. To see results right away: in the Identity provider policy, **temporarily disable Learning mode** (during learning, only High alerts are raised). Then push the policy to the DCs.
2. Run the commands:

```
net group "Domain Admins" /domain      :: ISIDP (SAMR) + IDR (decoy in the response)
dsquery * -filter "(admincount=1)"      :: ISIDP (LDAP), requires RSAT AD Tools
```

3. Check the `Alerts` sidebar (period *Last 1 hour*), **Detection Engine** filter:
   * `ADSecure-DC`, `-SAMR` or `-LDAP` for ISIDP (privileged account enumeration).
   * `ADSecure-EP` for IDR. With a 25.2.3+ agent, look for the indicator in `Event Search` instead.
4. Re-enable Learning mode once the test is validated.

## Final check

* The AD Connector shows an active status in `Policies and settings` > `Identity Security` > `Active Directory`.
* ISPM misconfigurations appear in the **Misconfigurations** sidebar, Identity tab.
* The Conditional Access policy and the Identity provider policy are active.
* The Identity protection policy is active.
* The `Dashboards` > `Identity` dashboard shows data, and alerts are visible in `Alerts` > `Identity`.
* AD and Entra assets are visible in `Inventory` > `Identity`.

## Troubleshooting

<details>

<summary>Save error: Authentication failed</summary>

Check the account and password (and any lockout).

</details>

<details>

<summary>Save error: LDAPS connection failed</summary>

Check the DC certificate and port 636, or switch back to LDAP.

</details>

<details>

<summary>Save error: The user account does not have the permissions…</summary>

Review the rights in [Create the AD service account](#create-the-ad-service-account).

</details>

<details>

<summary>Save error: Domain Controller down / not available / busy</summary>

Check DNS and flows from the AD Connector, then retry.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/mdr/deploy/sentinelone/add-on/identity-security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.