Group Details Page

The Group Details page provides information about the selected Active Directory group, threats generated by the group, and group membership.

The top of the page displays a group profile card which may contain the following information about the group:

• Name
• DN
• Sam Account Name
• Object GUID
• Object Type
• Domain
• Tags, with an option to add additional tags

The Group Details page has the following tabs:

• Threats Tab
• Members Tab
• Group Membership Tab

Threats Tab

The Threats tab for a group displays the threats detected for the group by timeframe.

A key for threat types is displayed below the chart.

Members Tab

The Members tab displays information about its members.

The Membership tab displays two tables:

• Direct Member – Lists users who are direct members of the group

• All Members – has the following two tables:

  • Domain Admins – Users responsible for managing and controlling settings within the domain
  • Domain Guests – Temporary accounts who need limited access to the domain

Each table has the following columns:

• Name – The display name of the member
• Domain – The domain name of the member
• Email – The email address of the member
• Title – The member's job title
• Department – The member's department

Group Membership Tab

The Group Membership tab displays a table that lists the users who are members of the group.

The Group Membership tab displays the groups that the group is a member of. Here, 'the group' refers to the group whose details you are viewing.

The tab has two sub-tabs:

• Direct Member Of – Lists groups the group is a direct member of
• Indirect Member Of – Lists groups the group is a member of via membership in a nested group

Each sub-tab displays a table with the following columns:

• Name - The name of the group. Click the link to view group details.
• Domain - Name of the domain. This may be either the domain DNS name or domain controller hostname.
• Tags - The tag present on the perpetrator, file, or host associated with the event