PingCastle
This integration will run a server that will listen for PingCastle XML reports.
Vulnerability Management · PingCastle
Details
| ID | PingCastle |
|---|---|
| Provider | Netwrix |
| Category | Vulnerability Management |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.12.11.3982393 |
| Supported Modules | Agentix XSIAM |
README
This integration will run a server that will listen for PingCastle XML reports.
This integration was integrated and tested with version 6.0.0 of PingCastle.
PingCastle is a long-running integration. For more information about long-running integrations, see the Cortex XSOAR 8 Cloud, Cortex XSOAR 8 On-prem or Cortex XSIAM documentation.
Configure PingCastle in Cortex
| Parameter | Description | Required |
|---|---|---|
| API Key | The API Key PingCastle must use to send reports. | True |
| Long running instance | Whether this instance should listen for reports. | False |
| Listen port, e.g. 7000 | Runs the service on this port from within Cortex XSOAR. Requires a unique port for each long-running integration instance. Do not use the same port for multiple instances. Note: If you click the test button more than once, a failure may occur mistakenly indicating that the port is already in use. (For Cortex XSOAR 8 and Cortex XSIAM) If using an engine, you must enter a Listen Port. If not using an engine, do not enter a Listen Port and an unused port will automatically be generated when the instance is saved. |
False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
pingcastle-get-report
Get the Currently saved Ping Castle Report
Base Command
pingcastle-get-report
Input
| Argument Name | Description | Required |
|---|---|---|
| delete_report | Whether to delete the report after getting it or save it to allow retrieving it again. Possible values are: Yes, No. Default is No. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| PingCastle.Report.report | String | The XML report sent by Ping Castle |
Command Example
!pingcastle-get-report delete_report=No
Context Example
{
"PingCastle": {
"Report": {
"report": "<?xml version=\"1.0\" encoding=\"utf-8\"?><HealthcheckData xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"><EngineVersion>2.9.2.0</EngineVersion><GenerationDate>2021-04-13T11:16:53.4987279-07:00</GenerationDate><Level>Normal</Level><MaturityLevel>2</MaturityLevel><DomainFQDN>pingcastledemo.local</DomainFQDN><NetBIOSName>PINGCASTLEDEMO</NetBIOSName><ForestFQDN>pingcastledemo.local</ForestFQDN><DomainCreation>2021-03-09T10:46:54</DomainCreation><DomainSid>S-1-5-21-2115980419-2321553098-4164854430</DomainSid><DomainFunctionalLevel>7</DomainFunctionalLevel><ForestFunctionalLevel>7</ForestFunctionalLevel><SchemaVersion>88</SchemaVersion><SchemaInternalVersion>0</SchemaInternalVersion><IsRecycleBinEnabled>false</IsRecycleBinEnabled><SchemaLastChanged>0001-01-01T00:00:00</SchemaLastChanged><NumberOfDC>1</NumberOfDC><GlobalScore>65</GlobalScore><StaleObjectsScore>16</StaleObjectsScore><PrivilegiedGroupScore>40</PrivilegiedGroupScore><TrustScore>0</TrustScore><AnomalyScore>65</AnomalyScore><Trusts /><DomainControllers><HealthcheckDomainController><DCName>WIN2019-AD-SX</DCName><CreationDate>2021-03-09T10:47:41</CreationDate><StartupTime>2021-03-09T03:48:59.4415839-08:00</StartupTime><LastComputerLogonDate>2021-04-09T04:49:10.2174788-07:00</LastComputerLogonDate><DistinguishedName>CN=WIN2019-AD-SX,OU=Domain Controllers,DC=pingcastledemo,DC=local</DistinguishedName><OperatingSystem>Windows 2019</OperatingSystem><OwnerSID>S-1-5-21-2115980419-2321553098-4164854430-512</OwnerSID><OwnerName>PINGCASTLEDEMO\\Domain Admins</OwnerName><HasNullSession>false</HasNullSession><SupportSMB1>false</SupportSMB1><SMB1SecurityMode>NotTested</SMB1SecurityMode><SupportSMB2OrSMB3>true</SupportSMB2OrSMB3><SMB2SecurityMode>SmbSigningEnabled SmbSigningRequired</SMB2SecurityMode><RemoteSpoolerDetected>true</RemoteSpoolerDetected><IP><string>fe80::717e:f51a:66a3:2fa2%15</string><string>10.158.106.123</string></IP><FSMO><string>PDC</string><string>RID pool manager</string><string>Infrastructure master</string><string>Schema master</string><string>Domain naming Master</string></FSMO><LDAPSProtocols /><PwdLastSet>2021-04-08T16:34:37.9205977-07:00</PwdLastSet><RODC>false</RODC><SYSVOLOverwrite>false</SYSVOLOverwrite></HealthcheckDomainController></DomainControllers><Sites><HealthcheckSite><SiteName>Default-First-Site-Name</SiteName><Networks /></HealthcheckSite></Sites><lDAPIPDenyList /><PreWindows2000AnonymousAccess>false</PreWindows2000AnonymousAccess><PreWindows2000NoDefault>false</PreWindows2000NoDefault><DsHeuristicsAnonymousAccess>false</DsHeuristicsAnonymousAccess><DsHeuristicsAdminSDExMaskModified>false</DsHeuristicsAdminSDExMaskModified><DsHeuristicsDoListObject>false</DsHeuristicsDoListObject><DsHeuristicsAllowAnonNSPI>false</DsHeuristicsAllowAnonNSPI><UsingNTFRSForSYSVOL>false</UsingNTFRSForSYSVOL><RiskRules><HealthcheckRiskRule><Points>20</Points><Category>PrivilegedAccounts</Category><Model>AccountTakeOver</Model><RiskId>P-Delegated</RiskId><Rationale>Presence of Admin accounts which have not the flag \"this account is sensitive and cannot be delegated\": 1</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>15</Points><Category>Anomalies</Category><Model>PassTheCredential</Model><RiskId>A-LAPS-Not-Installed</RiskId><Rationale>LAPS doesn't seem to be installed</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>15</Points><Category>Anomalies</Category><Model>Backup</Model><RiskId>A-BackupMetadata</RiskId><Rationale>Last AD backup has been performed 35 day(s) ago</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>PrivilegedAccounts</Category><Model>IrreversibleChange</Model><RiskId>P-SchemaAdmin</RiskId><Rationale>The group Schema Admins is not empty: 1 account(s)</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>Anomalies</Category><Model>Audit</Model><RiskId>A-AuditDC</RiskId><Rationale>The audit policy on domain controllers does not collect key events.</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>PrivilegedAccounts</Category><Model>IrreversibleChange</Model><RiskId>P-RecycleBin</RiskId><Rationale>The Recycle Bin is not enabled</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>StaleObjects</Category><Model>Provisioning</Model><RiskId>S-ADRegistration</RiskId><Rationale>Non-admin users can add up to 10 computer(s) to a domain</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>Anomalies</Category><Model>PassTheCredential</Model><RiskId>A-DC-Spooler</RiskId><Rationale>The spooler service is remotely accessible from 1 DC</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>Anomalies</Category><Model>WeakPassword</Model><RiskId>A-MinPwdLen</RiskId><Rationale>Policy where the password length is less than 8 characters: 1</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>5</Points><Category>StaleObjects</Category><Model>NetworkTopography</Model><RiskId>S-DC-SubnetMissing</RiskId><Rationale>The subnet declaration is incomplete [1 IP of DC not found in declared subnets]</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>5</Points><Category>Anomalies</Category><Model>Backup</Model><RiskId>A-NotEnoughDC</RiskId><Rationale>The number of DCs is too small to provide redundancy: 1 DC</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>1</Points><Category>StaleObjects</Category><Model>ObjectConfig</Model><RiskId>S-PwdNeverExpires</RiskId><Rationale>Number of accounts which has never-expiring passwords: 2</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>Audit</Model><RiskId>A-AuditPowershell</RiskId><Rationale>The powershell audit configuration is not fully enabled.</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>Reconnaissance</Model><RiskId>A-NoNetSessionHardening</RiskId><Rationale>No GPO has been found which implements NetCease</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>WeakPassword</Model><RiskId>A-NoServicePolicy</RiskId><Rationale>No password policy for service account found (MinimumPasswordLength>=20)</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>NetworkSniffing</Model><RiskId>A-NoGPOLLMNR</RiskId><Rationale>No GPO has been found which disables LLMNR or at least one GPO does enable it explicitly</Rationale></HealthcheckRiskRule></RiskRules><UserAccountData><Number>3</Number><NumberEnabled>2</NumberEnabled><NumberDisabled>1</NumberDisabled><NumberActive>2</NumberActive><NumberInactive>0</NumberInactive><NumberLocked>0</NumberLocked><NumberPwdNeverExpires>2</NumberPwdNeverExpires><NumberSidHistory>0</NumberSidHistory><NumberPwdNotRequired>0</NumberPwdNotRequired><NumberBadPrimaryGroup>0</NumberBadPrimaryGroup><NumberDesEnabled>0</NumberDesEnabled><NumberTrustedToAuthenticateForDelegation>0</NumberTrustedToAuthenticateForDelegation><NumberReversibleEncryption>0</NumberReversibleEncryption><NumberDuplicate>0</NumberDuplicate><NumberNoPreAuth>0</NumberNoPreAuth></UserAccountData><ComputerAccountData><Number>1</Number><NumberEnabled>1</NumberEnabled><NumberDisabled>0</NumberDisabled><NumberActive>1</NumberActive><NumberInactive>0</NumberInactive><NumberLocked>0</NumberLocked><NumberPwdNeverExpires>0</NumberPwdNeverExpires><NumberSidHistory>0</NumberSidHistory><ListDomainSidHistory /><NumberPwdNotRequired>0</NumberPwdNotRequired><NumberBadPrimaryGroup>0</NumberBadPrimaryGroup><NumberDesEnabled>0</NumberDesEnabled><NumberTrustedToAuthenticateForDelegation>1</NumberTrustedToAuthenticateForDelegation><NumberReversibleEncryption>0</NumberReversibleEncryption><NumberDuplicate>0</NumberDuplicate><NumberNoPreAuth>0</NumberNoPreAuth></ComputerAccountData><OperatingSystem><HealthcheckOSData><OperatingSystem>Windows 2019</OperatingSystem><NumberOfOccurence>1</NumberOfOccurence><data><Number>1</Number><NumberEnabled>1</NumberEnabled><NumberDisabled>0</NumberDisabled><NumberActive>1</NumberActive><NumberInactive>0</NumberInactive><NumberLocked>0</NumberLocked><NumberPwdNeverExpires>0</NumberPwdNeverExpires><NumberSidHistory>0</NumberSidHistory><NumberPwdNotRequired>0</NumberPwdNotRequired><NumberBadPrimaryGroup>0</NumberBadPrimaryGroup><NumberDesEnabled>0</NumberDesEnabled><NumberTrustedToAuthenticateForDelegation>1</NumberTrustedToAuthenticateForDelegation><NumberReversibleEncryption>0</NumberReversibleEncryption><NumberDuplicate>0</NumberDuplicate><NumberNoPreAuth>0</NumberNoPreAuth></data></HealthcheckOSData></OperatingSystem><GPOInfo><GPOInfo><GPOName>Default Domain Policy</GPOName><GPOId>{31B2F340-016D-11D2-945F-00C04FB984F9}</GPOId><IsDisabled>false</IsDisabled><AppliedTo><string>DC=pingcastledemo,DC=local</string></AppliedTo><AppliedOrder><int>1</int></AppliedOrder></GPOInfo><GPOInfo><GPOName>Default Domain Controllers Policy</GPOName><GPOId>{6AC1786C-016F-11D2-945F-00C04fB984F9}</GPOId><IsDisabled>false</IsDisabled><AppliedTo><string>OU=Domain Controllers,DC=pingcastledemo,DC=local</string></AppliedTo><AppliedOrder><int>1</int></AppliedOrder></GPOInfo></GPOInfo><LoginScript><HealthcheckLoginScriptData><LoginScript>None</LoginScript><NumberOfOccurence>2</NumberOfOccurence><Delegation /></HealthcheckLoginScriptData></LoginScript><LastADBackup>2021-03-09T03:47:51-08:00</LastADBackup><LAPSInstalled>9999-12-31T23:59:59.9999999</LAPSInstalled><KrbtgtLastChangeDate>2021-03-09T02:47:41.9719605-08:00</KrbtgtLastChangeDate><KrbtgtLastVersion>2</KrbtgtLastVersion><ExchangePrivEscVulnerable>false</ExchangePrivEscVulnerable><AdminLastLoginDate>2021-04-03T08:23:12.3112318-07:00</AdminLastLoginDate><GPPPassword /><GPPFileDeployed /><GPOAuditSimple /><GPOAuditAdvanced /><GPPPasswordPolicy><GPPSecurityPolicy><Properties><GPPSecurityPolicyProperty><Property>MinimumPasswordAge</Property><Value>1</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>MaximumPasswordAge</Property><Value>42</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>MinimumPasswordLength</Property><Value>7</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>PasswordComplexity</Property><Value>1</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>PasswordHistorySize</Property><Value>24</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>LockoutBadCount</Property><Value>0</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>ClearTextPassword</Property><Value>0</Value></GPPSecurityPolicyProperty></Properties><GPOName>Default Domain Policy</GPOName><GPOId>{31B2F340-016D-11D2-945F-00C04FB984F9}</GPOId></GPPSecurityPolicy></GPPPasswordPolicy><GPOLsaPolicy /><GPOScreenSaverPolicy /><GPOEventForwarding /><GPODelegation /><TrustedCertificates /><PrivilegedGroups><HealthCheckGroupData><GroupName>Account Operators</GroupName><DistinguishedName>CN=Account Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Administrators</GroupName><DistinguishedName>CN=Administrators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Backup Operators</GroupName><DistinguishedName>CN=Backup Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Certificate Operators</GroupName><DistinguishedName>CN=Cryptographic Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Certificate Publishers</GroupName><DistinguishedName>CN=Cert Publishers,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Dns Admins</GroupName><DistinguishedName>CN=DnsAdmins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Domain Administrators</GroupName><DistinguishedName>CN=Domain Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Enterprise Administrators</GroupName><DistinguishedName>CN=Enterprise Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Enterprise Key Administrators</GroupName><DistinguishedName>CN=Enterprise Key Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Key Administrators</GroupName><DistinguishedName>CN=Key Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Print Operators</GroupName><DistinguishedName>CN=Print Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Replicator</GroupName><DistinguishedName>CN=Replicator,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Schema Administrators</GroupName><DistinguishedName>CN=Schema Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Server Operators</GroupName><DistinguishedName>CN=Server Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData></PrivilegedGroups><AdminSDHolderNotOKCount>0</AdminSDHolderNotOKCount><UnixPasswordUsersCount>0</UnixPasswordUsersCount><SmartCardNotOKCount>0</SmartCardNotOKCount><DomainControllerWithNullSessionCount>0</DomainControllerWithNullSessionCount><SIDHistoryAuditingGroupPresent>false</SIDHistoryAuditingGroupPresent><MachineAccountQuota>10</MachineAccountQuota><ListHoneyPot /><DnsZones><HealthcheckDnsZones><name>pingcastledemo.local</name><InsecureUpdate>false</InsecureUpdate></HealthcheckDnsZones><HealthcheckDnsZones><name>RootDNSServers</name><InsecureUpdate>false</InsecureUpdate></HealthcheckDnsZones><HealthcheckDnsZones><name>106.158.10.in-addr.arpa</name><InsecureUpdate>false</InsecureUpdate></HealthcheckDnsZones></DnsZones><PasswordDistribution><Dist HigherBound=\"1\" Value=\"2\" /></PasswordDistribution><AzureADSSOLastPwdChange>0001-01-01T00:00:00</AzureADSSOLastPwdChange><AzureADSSOVersion>0</AzureADSSOVersion><PrivilegedDistributionLastLogon><Dist HigherBound=\"0\" Value=\"1\" /></PrivilegedDistributionLastLogon><PrivilegedDistributionPwdLastSet><Dist HigherBound=\"1\" Value=\"1\" /></PrivilegedDistributionPwdLastSet><ControlPaths><Data><data Name=\"S-1-5-32-548\" Description=\"Account Operators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"High\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-500\" Description=\"Administrator\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Critical\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-32-544\" Description=\"Administrators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Critical\"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-32-551\" Description=\"Backup Operators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"High\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"CN=Builtin,DC=pingcastledemo,DC=local\" Description=\"Builtin OU\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-32-569\" Description=\"Certificate Operators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-517\" Description=\"Certificate Publishers\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Other\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"CN=Computers,DC=pingcastledemo,DC=local\" Description=\"Computers container\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-1101\" Description=\"Dns Admins\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-512\" Description=\"Domain Administrators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Critical\"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-516\" Description=\"Domain Controllers\" Typology=\"Infrastructure\" ObjectRisk=\"Critical\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>1</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430\" Description=\"Domain Root\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-519\" Description=\"Enterprise Administrators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Critical\"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-527\" Description=\"Enterprise Key Administrators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-498\" Description=\"Enterprise Read Only Domain Controllers\" Typology=\"Infrastructure\" ObjectRisk=\"Other\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-520\" Description=\"Group Policy Creator Owners\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-526\" Description=\"Key Administrators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-502\" Description=\"Krbtgt account\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-32-550\" Description=\"Print Operators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-521\" Description=\"Read Only Domain Controllers\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-32-552\" Description=\"Replicator\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-21-2115980419-2321553098-4164854430-518\" Description=\"Schema Administrators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"Critical\"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"S-1-5-32-549\" Description=\"Server Operators\" Typology=\"PrivilegedAccount\" ObjectRisk=\"High\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name=\"CN=Users,DC=pingcastledemo,DC=local\" Description=\"Users container\" Typology=\"Infrastructure\" ObjectRisk=\"Medium\"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data></Data><Dependancies /><AnomalyAnalysis><CompromiseGraphAnomalyAnalysisData ObjectRisk=\"Critical\" NumberOfObjectsScreened=\"6\" NumberOfObjectsWithIndirect=\"0\" MaximumIndirectNumber=\"0\" MaximumDirectIndirectRatio=\"0\" /><CompromiseGraphAnomalyAnalysisData ObjectRisk=\"High\" NumberOfObjectsScreened=\"3\" NumberOfObjectsWithIndirect=\"0\" MaximumIndirectNumber=\"0\" MaximumDirectIndirectRatio=\"0\" /><CompromiseGraphAnomalyAnalysisData ObjectRisk=\"Medium\" NumberOfObjectsScreened=\"13\" NumberOfObjectsWithIndirect=\"0\" MaximumIndirectNumber=\"0\" MaximumDirectIndirectRatio=\"0\" /><CompromiseGraphAnomalyAnalysisData ObjectRisk=\"Other\" NumberOfObjectsScreened=\"2\" NumberOfObjectsWithIndirect=\"0\" MaximumIndirectNumber=\"0\" MaximumDirectIndirectRatio=\"0\" /></AnomalyAnalysis><GlobalScore>0</GlobalScore><StaleObjectsScore>0</StaleObjectsScore><PrivilegiedGroupScore>0</PrivilegiedGroupScore><TrustScore>0</TrustScore><AnomalyScore>0</AnomalyScore></ControlPaths></HealthcheckData>"
}
}
}
Human Readable Output
Results
report <?xml version="1.0" encoding="utf-8"?><HealthcheckData xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><EngineVersion>2.9.2.0</EngineVersion><GenerationDate>2021-04-13T11:16:53.4987279-07:00</GenerationDate><Level>Normal</Level><MaturityLevel>2</MaturityLevel><DomainFQDN>pingcastledemo.local</DomainFQDN><NetBIOSName>PINGCASTLEDEMO</NetBIOSName><ForestFQDN>pingcastledemo.local</ForestFQDN><DomainCreation>2021-03-09T10:46:54</DomainCreation><DomainSid>S-1-5-21-2115980419-2321553098-4164854430</DomainSid><DomainFunctionalLevel>7</DomainFunctionalLevel><ForestFunctionalLevel>7</ForestFunctionalLevel><SchemaVersion>88</SchemaVersion><SchemaInternalVersion>0</SchemaInternalVersion><IsRecycleBinEnabled>false</IsRecycleBinEnabled><SchemaLastChanged>0001-01-01T00:00:00</SchemaLastChanged><NumberOfDC>1</NumberOfDC><GlobalScore>65</GlobalScore><StaleObjectsScore>16</StaleObjectsScore><PrivilegiedGroupScore>40</PrivilegiedGroupScore><TrustScore>0</TrustScore><AnomalyScore>65</AnomalyScore><Trusts /><DomainControllers><HealthcheckDomainController><DCName>WIN2019-AD-SX</DCName><CreationDate>2021-03-09T10:47:41</CreationDate><StartupTime>2021-03-09T03:48:59.4415839-08:00</StartupTime><LastComputerLogonDate>2021-04-09T04:49:10.2174788-07:00</LastComputerLogonDate><DistinguishedName>CN=WIN2019-AD-SX,OU=Domain Controllers,DC=pingcastledemo,DC=local</DistinguishedName><OperatingSystem>Windows 2019</OperatingSystem><OwnerSID>S-1-5-21-2115980419-2321553098-4164854430-512</OwnerSID><OwnerName>PINGCASTLEDEMO\Domain Admins</OwnerName><HasNullSession>false</HasNullSession><SupportSMB1>false</SupportSMB1><SMB1SecurityMode>NotTested</SMB1SecurityMode><SupportSMB2OrSMB3>true</SupportSMB2OrSMB3><SMB2SecurityMode>SmbSigningEnabled SmbSigningRequired</SMB2SecurityMode><RemoteSpoolerDetected>true</RemoteSpoolerDetected><IP><string>fe80::717e:f51a:66a3:2fa2%15</string><string>10.158.106.123</string></IP><FSMO><string>PDC</string><string>RID pool manager</string><string>Infrastructure master</string><string>Schema master</string><string>Domain naming Master</string></FSMO><LDAPSProtocols /><PwdLastSet>2021-04-08T16:34:37.9205977-07:00</PwdLastSet><RODC>false</RODC><SYSVOLOverwrite>false</SYSVOLOverwrite></HealthcheckDomainController></DomainControllers><Sites><HealthcheckSite><SiteName>Default-First-Site-Name</SiteName><Networks /></HealthcheckSite></Sites><lDAPIPDenyList /><PreWindows2000AnonymousAccess>false</PreWindows2000AnonymousAccess><PreWindows2000NoDefault>false</PreWindows2000NoDefault><DsHeuristicsAnonymousAccess>false</DsHeuristicsAnonymousAccess><DsHeuristicsAdminSDExMaskModified>false</DsHeuristicsAdminSDExMaskModified><DsHeuristicsDoListObject>false</DsHeuristicsDoListObject><DsHeuristicsAllowAnonNSPI>false</DsHeuristicsAllowAnonNSPI><UsingNTFRSForSYSVOL>false</UsingNTFRSForSYSVOL><RiskRules><HealthcheckRiskRule><Points>20</Points><Category>PrivilegedAccounts</Category><Model>AccountTakeOver</Model><RiskId>P-Delegated</RiskId><Rationale>Presence of Admin accounts which have not the flag "this account is sensitive and cannot be delegated": 1</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>15</Points><Category>Anomalies</Category><Model>PassTheCredential</Model><RiskId>A-LAPS-Not-Installed</RiskId><Rationale>LAPS doesn't seem to be installed</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>15</Points><Category>Anomalies</Category><Model>Backup</Model><RiskId>A-BackupMetadata</RiskId><Rationale>Last AD backup has been performed 35 day(s) ago</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>PrivilegedAccounts</Category><Model>IrreversibleChange</Model><RiskId>P-SchemaAdmin</RiskId><Rationale>The group Schema Admins is not empty: 1 account(s)</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>Anomalies</Category><Model>Audit</Model><RiskId>A-AuditDC</RiskId><Rationale>The audit policy on domain controllers does not collect key events.</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>PrivilegedAccounts</Category><Model>IrreversibleChange</Model><RiskId>P-RecycleBin</RiskId><Rationale>The Recycle Bin is not enabled</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>StaleObjects</Category><Model>Provisioning</Model><RiskId>S-ADRegistration</RiskId><Rationale>Non-admin users can add up to 10 computer(s) to a domain</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>Anomalies</Category><Model>PassTheCredential</Model><RiskId>A-DC-Spooler</RiskId><Rationale>The spooler service is remotely accessible from 1 DC</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>10</Points><Category>Anomalies</Category><Model>WeakPassword</Model><RiskId>A-MinPwdLen</RiskId><Rationale>Policy where the password length is less than 8 characters: 1</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>5</Points><Category>StaleObjects</Category><Model>NetworkTopography</Model><RiskId>S-DC-SubnetMissing</RiskId><Rationale>The subnet declaration is incomplete [1 IP of DC not found in declared subnets]</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>5</Points><Category>Anomalies</Category><Model>Backup</Model><RiskId>A-NotEnoughDC</RiskId><Rationale>The number of DCs is too small to provide redundancy: 1 DC</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>1</Points><Category>StaleObjects</Category><Model>ObjectConfig</Model><RiskId>S-PwdNeverExpires</RiskId><Rationale>Number of accounts which has never-expiring passwords: 2</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>Audit</Model><RiskId>A-AuditPowershell</RiskId><Rationale>The powershell audit configuration is not fully enabled.</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>Reconnaissance</Model><RiskId>A-NoNetSessionHardening</RiskId><Rationale>No GPO has been found which implements NetCease</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>WeakPassword</Model><RiskId>A-NoServicePolicy</RiskId><Rationale>No password policy for service account found (MinimumPasswordLength>=20)</Rationale></HealthcheckRiskRule><HealthcheckRiskRule><Points>0</Points><Category>Anomalies</Category><Model>NetworkSniffing</Model><RiskId>A-NoGPOLLMNR</RiskId><Rationale>No GPO has been found which disables LLMNR or at least one GPO does enable it explicitly</Rationale></HealthcheckRiskRule></RiskRules><UserAccountData><Number>3</Number><NumberEnabled>2</NumberEnabled><NumberDisabled>1</NumberDisabled><NumberActive>2</NumberActive><NumberInactive>0</NumberInactive><NumberLocked>0</NumberLocked><NumberPwdNeverExpires>2</NumberPwdNeverExpires><NumberSidHistory>0</NumberSidHistory><NumberPwdNotRequired>0</NumberPwdNotRequired><NumberBadPrimaryGroup>0</NumberBadPrimaryGroup><NumberDesEnabled>0</NumberDesEnabled><NumberTrustedToAuthenticateForDelegation>0</NumberTrustedToAuthenticateForDelegation><NumberReversibleEncryption>0</NumberReversibleEncryption><NumberDuplicate>0</NumberDuplicate><NumberNoPreAuth>0</NumberNoPreAuth></UserAccountData><ComputerAccountData><Number>1</Number><NumberEnabled>1</NumberEnabled><NumberDisabled>0</NumberDisabled><NumberActive>1</NumberActive><NumberInactive>0</NumberInactive><NumberLocked>0</NumberLocked><NumberPwdNeverExpires>0</NumberPwdNeverExpires><NumberSidHistory>0</NumberSidHistory><ListDomainSidHistory /><NumberPwdNotRequired>0</NumberPwdNotRequired><NumberBadPrimaryGroup>0</NumberBadPrimaryGroup><NumberDesEnabled>0</NumberDesEnabled><NumberTrustedToAuthenticateForDelegation>1</NumberTrustedToAuthenticateForDelegation><NumberReversibleEncryption>0</NumberReversibleEncryption><NumberDuplicate>0</NumberDuplicate><NumberNoPreAuth>0</NumberNoPreAuth></ComputerAccountData><OperatingSystem><HealthcheckOSData><OperatingSystem>Windows 2019</OperatingSystem><NumberOfOccurence>1</NumberOfOccurence><data><Number>1</Number><NumberEnabled>1</NumberEnabled><NumberDisabled>0</NumberDisabled><NumberActive>1</NumberActive><NumberInactive>0</NumberInactive><NumberLocked>0</NumberLocked><NumberPwdNeverExpires>0</NumberPwdNeverExpires><NumberSidHistory>0</NumberSidHistory><NumberPwdNotRequired>0</NumberPwdNotRequired><NumberBadPrimaryGroup>0</NumberBadPrimaryGroup><NumberDesEnabled>0</NumberDesEnabled><NumberTrustedToAuthenticateForDelegation>1</NumberTrustedToAuthenticateForDelegation><NumberReversibleEncryption>0</NumberReversibleEncryption><NumberDuplicate>0</NumberDuplicate><NumberNoPreAuth>0</NumberNoPreAuth></data></HealthcheckOSData></OperatingSystem><GPOInfo><GPOInfo><GPOName>Default Domain Policy</GPOName><GPOId>{31B2F340-016D-11D2-945F-00C04FB984F9}</GPOId><IsDisabled>false</IsDisabled><AppliedTo><string>DC=pingcastledemo,DC=local</string></AppliedTo><AppliedOrder><int>1</int></AppliedOrder></GPOInfo><GPOInfo><GPOName>Default Domain Controllers Policy</GPOName><GPOId>{6AC1786C-016F-11D2-945F-00C04fB984F9}</GPOId><IsDisabled>false</IsDisabled><AppliedTo><string>OU=Domain Controllers,DC=pingcastledemo,DC=local</string></AppliedTo><AppliedOrder><int>1</int></AppliedOrder></GPOInfo></GPOInfo><LoginScript><HealthcheckLoginScriptData><LoginScript>None</LoginScript><NumberOfOccurence>2</NumberOfOccurence><Delegation /></HealthcheckLoginScriptData></LoginScript><LastADBackup>2021-03-09T03:47:51-08:00</LastADBackup><LAPSInstalled>9999-12-31T23:59:59.9999999</LAPSInstalled><KrbtgtLastChangeDate>2021-03-09T02:47:41.9719605-08:00</KrbtgtLastChangeDate><KrbtgtLastVersion>2</KrbtgtLastVersion><ExchangePrivEscVulnerable>false</ExchangePrivEscVulnerable><AdminLastLoginDate>2021-04-03T08:23:12.3112318-07:00</AdminLastLoginDate><GPPPassword /><GPPFileDeployed /><GPOAuditSimple /><GPOAuditAdvanced /><GPPPasswordPolicy><GPPSecurityPolicy><Properties><GPPSecurityPolicyProperty><Property>MinimumPasswordAge</Property><Value>1</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>MaximumPasswordAge</Property><Value>42</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>MinimumPasswordLength</Property><Value>7</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>PasswordComplexity</Property><Value>1</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>PasswordHistorySize</Property><Value>24</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>LockoutBadCount</Property><Value>0</Value></GPPSecurityPolicyProperty><GPPSecurityPolicyProperty><Property>ClearTextPassword</Property><Value>0</Value></GPPSecurityPolicyProperty></Properties><GPOName>Default Domain Policy</GPOName><GPOId>{31B2F340-016D-11D2-945F-00C04FB984F9}</GPOId></GPPSecurityPolicy></GPPPasswordPolicy><GPOLsaPolicy /><GPOScreenSaverPolicy /><GPOEventForwarding /><GPODelegation /><TrustedCertificates /><PrivilegedGroups><HealthCheckGroupData><GroupName>Account Operators</GroupName><DistinguishedName>CN=Account Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Administrators</GroupName><DistinguishedName>CN=Administrators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Backup Operators</GroupName><DistinguishedName>CN=Backup Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Certificate Operators</GroupName><DistinguishedName>CN=Cryptographic Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Certificate Publishers</GroupName><DistinguishedName>CN=Cert Publishers,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Dns Admins</GroupName><DistinguishedName>CN=DnsAdmins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Domain Administrators</GroupName><DistinguishedName>CN=Domain Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Enterprise Administrators</GroupName><DistinguishedName>CN=Enterprise Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Enterprise Key Administrators</GroupName><DistinguishedName>CN=Enterprise Key Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Key Administrators</GroupName><DistinguishedName>CN=Key Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Print Operators</GroupName><DistinguishedName>CN=Print Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Replicator</GroupName><DistinguishedName>CN=Replicator,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Schema Administrators</GroupName><DistinguishedName>CN=Schema Admins,CN=Users,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>1</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>1</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>1</NumberOfMemberActive><NumberOfMemberEnabled>1</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>1</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData><HealthCheckGroupData><GroupName>Server Operators</GroupName><DistinguishedName>CN=Server Operators,CN=Builtin,DC=pingcastledemo,DC=local</DistinguishedName><NumberOfMember>0</NumberOfMember><NumberOfMemberDisabled>0</NumberOfMemberDisabled><NumberOfMemberPwdNotRequired>0</NumberOfMemberPwdNotRequired><NumberOfMemberPwdNeverExpires>0</NumberOfMemberPwdNeverExpires><NumberOfMemberLocked>0</NumberOfMemberLocked><NumberOfMemberInactive>0</NumberOfMemberInactive><NumberOfMemberActive>0</NumberOfMemberActive><NumberOfMemberEnabled>0</NumberOfMemberEnabled><NumberOfMemberCanBeDelegated>0</NumberOfMemberCanBeDelegated><NumberOfExternalMember>0</NumberOfExternalMember><NumberOfSmartCardRequired>0</NumberOfSmartCardRequired><NumberOfServiceAccount>0</NumberOfServiceAccount><NumberOfMemberInProtectedUsers>0</NumberOfMemberInProtectedUsers></HealthCheckGroupData></PrivilegedGroups><AdminSDHolderNotOKCount>0</AdminSDHolderNotOKCount><UnixPasswordUsersCount>0</UnixPasswordUsersCount><SmartCardNotOKCount>0</SmartCardNotOKCount><DomainControllerWithNullSessionCount>0</DomainControllerWithNullSessionCount><SIDHistoryAuditingGroupPresent>false</SIDHistoryAuditingGroupPresent><MachineAccountQuota>10</MachineAccountQuota><ListHoneyPot /><DnsZones><HealthcheckDnsZones><name>pingcastledemo.local</name><InsecureUpdate>false</InsecureUpdate></HealthcheckDnsZones><HealthcheckDnsZones><name>RootDNSServers</name><InsecureUpdate>false</InsecureUpdate></HealthcheckDnsZones><HealthcheckDnsZones><name>106.158.10.in-addr.arpa</name><InsecureUpdate>false</InsecureUpdate></HealthcheckDnsZones></DnsZones><PasswordDistribution><Dist HigherBound="1" Value="2" /></PasswordDistribution><AzureADSSOLastPwdChange>0001-01-01T00:00:00</AzureADSSOLastPwdChange><AzureADSSOVersion>0</AzureADSSOVersion><PrivilegedDistributionLastLogon><Dist HigherBound="0" Value="1" /></PrivilegedDistributionLastLogon><PrivilegedDistributionPwdLastSet><Dist HigherBound="1" Value="1" /></PrivilegedDistributionPwdLastSet><ControlPaths><Data><data Name="S-1-5-32-548" Description="Account Operators" Typology="PrivilegedAccount" ObjectRisk="High"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-500" Description="Administrator" Typology="PrivilegedAccount" ObjectRisk="Critical"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-32-544" Description="Administrators" Typology="PrivilegedAccount" ObjectRisk="Critical"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-32-551" Description="Backup Operators" Typology="PrivilegedAccount" ObjectRisk="High"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="CN=Builtin,DC=pingcastledemo,DC=local" Description="Builtin OU" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-32-569" Description="Certificate Operators" Typology="PrivilegedAccount" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-517" Description="Certificate Publishers" Typology="PrivilegedAccount" ObjectRisk="Other"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="CN=Computers,DC=pingcastledemo,DC=local" Description="Computers container" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-1101" Description="Dns Admins" Typology="PrivilegedAccount" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-512" Description="Domain Administrators" Typology="PrivilegedAccount" ObjectRisk="Critical"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-516" Description="Domain Controllers" Typology="Infrastructure" ObjectRisk="Critical"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>1</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430" Description="Domain Root" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-519" Description="Enterprise Administrators" Typology="PrivilegedAccount" ObjectRisk="Critical"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-527" Description="Enterprise Key Administrators" Typology="PrivilegedAccount" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-498" Description="Enterprise Read Only Domain Controllers" Typology="Infrastructure" ObjectRisk="Other"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-520" Description="Group Policy Creator Owners" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-526" Description="Key Administrators" Typology="PrivilegedAccount" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-502" Description="Krbtgt account" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-32-550" Description="Print Operators" Typology="PrivilegedAccount" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-521" Description="Read Only Domain Controllers" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-32-552" Description="Replicator" Typology="PrivilegedAccount" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-21-2115980419-2321553098-4164854430-518" Description="Schema Administrators" Typology="PrivilegedAccount" ObjectRisk="Critical"><NumberOfDirectUserMembers>1</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="S-1-5-32-549" Description="Server Operators" Typology="PrivilegedAccount" ObjectRisk="High"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data><data Name="CN=Users,DC=pingcastledemo,DC=local" Description="Users container" Typology="Infrastructure" ObjectRisk="Medium"><NumberOfDirectUserMembers>0</NumberOfDirectUserMembers><NumberOfDirectComputerMembers>0</NumberOfDirectComputerMembers><NumberOfIndirectMembers>0</NumberOfIndirectMembers><NumberOfDeletedObjects>0</NumberOfDeletedObjects><Dependancies /></data></Data><Dependancies /><AnomalyAnalysis><CompromiseGraphAnomalyAnalysisData ObjectRisk="Critical" NumberOfObjectsScreened="6" NumberOfObjectsWithIndirect="0" MaximumIndirectNumber="0" MaximumDirectIndirectRatio="0" /><CompromiseGraphAnomalyAnalysisData ObjectRisk="High" NumberOfObjectsScreened="3" NumberOfObjectsWithIndirect="0" MaximumIndirectNumber="0" MaximumDirectIndirectRatio="0" /><CompromiseGraphAnomalyAnalysisData ObjectRisk="Medium" NumberOfObjectsScreened="13" NumberOfObjectsWithIndirect="0" MaximumIndirectNumber="0" MaximumDirectIndirectRatio="0" /><CompromiseGraphAnomalyAnalysisData ObjectRisk="Other" NumberOfObjectsScreened="2" NumberOfObjectsWithIndirect="0" MaximumIndirectNumber="0" MaximumDirectIndirectRatio="0" /></AnomalyAnalysis><GlobalScore>0</GlobalScore><StaleObjectsScore>0</StaleObjectsScore><PrivilegiedGroupScore>0</PrivilegiedGroupScore><TrustScore>0</TrustScore><AnomalyScore>0</AnomalyScore></ControlPaths></HealthcheckData>
Configuration parameters
apikey— API Key (required)longRunning— Long running instancelongRunningPort— Listen port, e.g. 7000certificate— Certificate (Required for HTTPS)private_key— Private Key (Required for HTTPS)
Commands (1)
-
pingcastle-get-reportGet the Currently saved Ping Castle Report.
import random import socket import ssl import string import traceback from http.server import BaseHTTPRequestHandler, HTTPServer from tempfile import NamedTemporaryFile import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 from CommonServerUserPython import * # noqa class PingCastleHTTPServer(BaseHTTPRequestHandler): token = "" report = "" def _set_response(self, code, content_type): self.send_response(code) self.send_header("Content-type", content_type) self.end_headers() def do_GET(self): """ Handle GET requests. This server does not accept GET requests. """ self._set_response(400, "text/html") self.wfile.write(b"no GET requests") def do_POST(self): """ Handle POST requests - Login and SendReport """ try: content_length = int(self.headers.get("Content-Length")) # type: ignore[arg-type] post_data = self.rfile.read(content_length) try: request_json = json.loads(post_data) if self.path == "/api/Agent/Login": self._handle_login(request_json) elif self.path == "/api/Agent/SendReport": self._handle_send_report(request_json) else: self._set_response(404, "text/html") self.wfile.write(b"no such url") except json.JSONDecodeError: self._set_response(400, "text/html") self.wfile.write(b"invalid format") except Exception: demisto.error(traceback.format_exc()) def _handle_send_report(self, request_json: dict): """ Handle receiving a report from PingCastle making sure the token used is the token issued by this server. Args: request_json (dict): The JSON sent in the request. """ if self.headers.get("Authorization") is None: self._set_response(400, "text/html") self.wfile.write(b"missing token") return if self.headers.get("Authorization") != self.token: self._set_response(401, "text/html") self.wfile.write(b"Invalid Token") return if request_json.get("xmlReport") is None: self._set_response(400, "text/html") self.wfile.write(b"missing xmlReport") return self._set_report_context(request_json) self._create_incident(request_json) self._set_response(200, "text/html") def _create_incident(self, request_json: dict): """ Create an Incident from a report sent by PingCastle. Args: request_json (dict): The JSON sent in the request. """ incident = { "name": "PingCastle-report", "occurred": time.strftime("%Y-%m-%dT%H:%M:%SZ"), "rawJSON": json.dumps(request_json), } demisto.createIncidents([incident]) def _set_report_context(self, request_json: dict): """ Store the report in the integration context so that it may be retrieved by the get-report command. Args: request_json (dict): The JSON sent in the request. """ context: dict = get_integration_context() context["report"] = request_json.get("xmlReport") set_integration_context(context) def _handle_login(self, request_json): """ Handle receiving a login request from PingCastle making sure the API Key is the one set in this integration. Args: request_json (dict): The JSON sent in the request. """ if request_json.get("apikey") is None: self._set_response(400, "text/html") self.wfile.write(b"missing api key") return if request_json.get("apikey") == demisto.params().get("apikey"): choices = string.ascii_uppercase + string.digits PingCastleHTTPServer.token = "".join(random.choices(choices, k=10)) self._set_response(200, "text/html") self.wfile.write(PingCastleHTTPServer.token.encode("utf-8")) def listen_for_reports(params): """ long-running-execution command: listen forever for reports sent by PingCastle Args: params (dict): A dictionary of the arguments to the integration """ certificate = str(params.get("certificate")) private_key = str(params.get("private_key")) port = int(params.get("longRunningPort")) while True: try: listener = HTTPServer(("", port), PingCastleHTTPServer) if certificate and private_key: certificate_file = NamedTemporaryFile(mode="w", delete=False) certificate_path = certificate_file.name certificate_file.write(certificate) certificate_file.close() private_key_file = NamedTemporaryFile(mode="w", delete=False) private_key_path = private_key_file.name private_key_file.write(private_key) private_key_file.close() listener.socket = ssl.wrap_socket( # type: ignore[attr-defined] listener.socket, keyfile=private_key_path, certfile=certificate_path, server_side=True, ssl_version=ssl.PROTOCOL_TLSv1_2, ) listener.serve_forever() except Exception: demisto.error(traceback.format_exc()) time.sleep(1) def get_report_command(args: dict): """ pingcastle-get-report command: Returns the last report sent by PingCastle Args: args (dict): A dict object containing the arguments for this command """ delete_report = args.get("delete_report") == "Yes" context = get_integration_context() report = context.get("report") if report is None: return "No report available" if delete_report: context.pop("report") set_integration_context(context) return CommandResults(outputs_prefix="PingCastle.Report", outputs={"report": report}, raw_response=report) def test_module(params: dict): """ Returning 'ok' indicates that the integration works like it is supposed to. This test works by running the listening server to see if it will run. Args: params (dict): The integration parameters Returns: 'ok' if test passed, anything else will fail the test. """ try: certificate = str(params.get("certificate")) private_key = str(params.get("private_key")) certificate_file = NamedTemporaryFile(mode="w", delete=False) certificate_path = certificate_file.name certificate_file.write(certificate) certificate_file.close() private_key_file = NamedTemporaryFile(mode="w", delete=False) private_key_path = private_key_file.name private_key_file.write(private_key) private_key_file.close() s = socket.socket() # pylint: disable=no-member ssl.wrap_socket( # type: ignore[attr-defined] s, keyfile=private_key_path, certfile=certificate_path, server_side=True, ssl_version=ssl.PROTOCOL_TLSv1_2 ) # pylint: enable=no-member return "ok" except ssl.SSLError as e: if e.reason == "KEY_VALUES_MISMATCH": return "Private and Public keys do not match" except Exception as e: return f"Test failed with the following error: {e!r}" def main() -> None: """main function, parses params and runs command functions""" params = demisto.params() command = demisto.command() args = demisto.args() demisto.debug(f"Command being called is {demisto.command()}") try: if command == "test-module": test_module(params) if command == "long-running-execution": listen_for_reports(params) elif command == "pingcastle-get-report": return_results(get_report_command(args)) # Log exceptions and return errors except Exception as e: demisto.error(traceback.format_exc()) # print the traceback return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}") if __name__ in ("__main__", "__builtin__", "builtins"): main()