D3-ANET
Authentication Event Monitoring
Monitor authentication events across systems to detect credential abuse, brute force attacks, and unauthorized access.
D3FEND / Detect
Implementation
- Centralize authentication logs
- Alert on failed authentication patterns
- Monitor for impossible travel
- Track privileged account usage
- Detect password spraying
Tools
- Azure AD Identity Protection
- Splunk ES
- Microsoft Defender for Identity
- LogRhythm
- Securonix