Name: Beyond the Breach: Orchestrating a Bulletproof Identity Defense
Uploaded: 2026-05-19T10:20:08.595Z
Duration: 1 h 20 min 4 s
Description: Beyond the Breach: Orchestrating a Bulletproof Identity Defense

Transcript for "Beyond the Breach: Orchestrating a Bulletproof Identity Defense": Hi, everyone. Welcome to this webinar. My name is Kev Johnson. I run technical marketing here at Rubrik for our identity and security business. I'm joined on this webinar by my good friend, Ant. I'm joined to just introduce yourself. Hi, everyone. My name is Ant Perry. I am, one of the tech leads within Rubrik X, and I work across, Europe supporting, our customers relating to topic of today, identity. But great to meet you all. Awesome. Awesome. Cool. So just to quickly run you through what we're gonna cover off, I'm gonna run through, some stats about the threat landscape, some of the challenges that a lot of our customers have been, coming up against when dealing with that that that changing threat landscape, and, you know, some of the some of the capabilities that Rubrik has brought to market through identity resilience. And then I'm gonna hand over to Ant, and he's gonna run through show you what the product actually does. So you can actually believe it's a real thing, not just some marketing guy who's, running through some slide where for you. Cool. So just to kick things off then, the threat landscape. Every single webinar, I I I seem to be, kicking out a bunch of different stats. Today, we've got the two on screen here. So 79%, it is this is in the, Rubik's Zero Labs report from November 2025. 79% of cyber attacks that that organizations that we surveyed had seen were were identity driven. In many cases, they were talking about things where there's there's no malware involved whatsoever. It's compromised identities getting in, getting to whatever it is that let you know, what whatever the the end goal is. And then from the, from the CSER, multi cloud report in 2024, three quarters of organizations are managing multiple identity providers. And that that poses a real problem as I'm gonna come across very very shortly. So just to kind of like take a step back, and again, you've probably seen a slide like this or, you know, sort of something along these lines a few times, especially if you've been on one of these webinars before. So what we what we what we see here is when when organizations have been thinking about business continuity and disaster recovery and how to how to improve posture and all of that stuff, they're focused really over over here on the right hand side on on the side of resources. So it's like, hey. How do I build, how do I how do I maintain uptime of my, VMware infrastructure? How do I make sure that my exchange services, you know, are still running? And then when you start thinking about things in the cloud as well, you know, you you have to architect things in a specific way so that, you know, a a specific if there if there's an, an outage in one area of that cloud, you're usually fine because you you have you have your workloads running elsewhere. And I'm not saying you don't need to do that, but one of the challenges you have is really the the elephant in the room is is identity. So if we have something like what we've got over on the left hand side here where we've got maybe, weak passwords or some leaks, leaks, tokens of API keys, those kinds of things. All that can lead to is the loss of your identity services. And if your identity services are unavailable, it kind of doesn't matter that all of the stuff on the right hand side still has five nines of uptime because nobody can access it. And really, how what how that manifests, if we kinda look at what we have over on over on the right hand side and and again, three quarters of organizations surveyed by CSA were saying that they were managing multiple identity providers. So, you know, in this case, let's say for example, we got active directory, we've got Okta, and then Microsoft on for ID. A lot of our customers have at least two, in some cases, three of these. And this this is great because they all have really, you know, really cool capabilities, but also the siloing is is a massive problem. So when identity fails, you the first thing you think of is that users just can't log in to whatever it is. You know, they can't get their, their email. They can't get to SharePoint. They can't log in to their their applications. And this is obviously a problem. But then the other side of things is you you need you need to start thinking about things like, when when you're when you're provisioning applications in the cloud, those those applications in themselves have have an identity. So those apps might stop being able to interact with each other. So not only are your users enabled unable to log in, but actually your applications stop talking to each other. And this can be super problematic. All of the automation that you've got out there as well, and you know, this includes automation that provisions identities. That has its own identity as well. So again, if your identity services are down, recovery can actually be super tricky. So you need to kinda think and make sure you don't don't end up in a in a little chicken and egg situation. And then finally, security policies. So if if something happens to, let's say for example, your conditional access policies, You may end up end up in a situation where perhaps your users can log in, but, they end up actually having more access than they should have in life if things were all in line with conditional access forces. And really, you know, this is this is just a kind of double double down on the fact that this is more than just, hey. I can't log into my computer. The yeah. Your your business really does just grind to a halt. And then if we think about some of the ways that the attackers might leverage your identity services, so that some of the kind of key key attacks that we see. So things like golden ticket, where where effectively the the attacker has complete ownership of your entire identity infrastructure. The skeleton key attack where they can leverage, Entra Connect, for example, to, to to move from active directory out into a global admin role within within on Friday. And also, I'll I'll I'll come back to that in a moment. Yeah. There's there's more on that front. And then DC shadow. So DC DC shadow effectively, the attacker adds a fake domain controller into your domain, inject some bad stuff, and then typically they'll remove it again so they can cover their tracks. DC shadow can be super super nasty because it's it's an easy way for an attacker to just do whatever they want. Once and once they've done that, they've they've got ownership of a of a active directory there. And again, you know, especially when we start thinking about things like skeleton key, this isn't just about active directory. All of these systems are interconnected. So in the event of an attacker being able to, to traverse from active directory back into on out into on for ID or, you know, potentially over into Okta, then if you have to do if you if you determine something bad has happened and you need to recover active directory, that's fine. You go through that whole process. As soon as you reconnect it back to your other IDPs, the attacker can just come back in from there. So this is problematic. And and typically how these things manifest, you know, we see we see things like the creation of privileged accounts. We see the eviction of privileged accounts as well. So once once an adversary compromises your identity services, it's relatively trivial for them to just basically kick all of your other admins out so that they can't get back in to fix things. You might also see things like hidden backdoors, and also changes to things like conditional access policies and group policies. And my favorite, the, the giant spaghetti monster slide. So if we look at how identity typically works across, across modern organizations, this is this is roughly how how how things can happen. So over on the left, we have what we call skim provisioning. So this is typically you will you'll usually see, you you you usually see that you've got something that is your single source of truth. In many cases, that's some sort of HR system. It could be something like Workday or BambooHR. And this is where all identity stuff begins. So somebody joins your company, they get created in that system. That system then uses SCIM to provision into something like active directory or Entre. So the identity comes in there. Now once an identity is compromised, let's say let's just say let's say it's active directory. It kinda doesn't matter, but just in this example. So that the the compromised identity is in active directory. Active directory as you can see from the, what from what's on the screen there. If you've got Okta in play, then there's an agent that you deploy onto your domain controllers that connects back up into Okta, and it helps with the provisioning process there. So we have a workflow where you have an identity that's created in, let's say, Workday. They then get created an identity in active directory that then provisions an identity in Okta. Similar kind of thing with Entra Connect with Entra ID. So identity ends up created in active directory and then based on the various rules in in on Entra Connect, it's then gonna provisionally an identity in on for ID and link those things together. And that's where, you know, they they get access to all of your applications. Now compromised identity is in active directory. We've seen how they they can then spread from there to Okta and to Entre. But also, you know, once they're connected into those systems, they have access to everything else. So if you're using single sign on to log in to, Amazon Web Services, for example, for actor can get in there. What what what roles do you have in in AWS, for example? They can also get access to things like Slack, which is something we saw, you know, the likes of Scattered Spider really like to go after. Things like Slack, things like SharePoint. All all of this stuff is super, super valuable. And all of this can happen from the compromise of a single identity. And as I mentioned earlier, you know, where where we have things like, IDPs that are joined using things like Entra Connect, what we can see happen here is the adversary compromises on for connect. Everything else is then compromised as well. So they can make changes to security groups, conditional access policies, they can change in their locations. But also over on the right hand side here, we've got other problems because they can make it impossible for your help desk to be able to help. They can wipe out they can remove the requirement for multi factor authentication and, you know, things like Microsoft three sixty five, it becomes very, very tricky to, you know, to to to to manage and monitor who's got access to what at that point. And this leaves you as an organization with a a bit of a a bit of a difficult conversation. A bit of a bit of an impossible decision to make really. So when it comes to recovering from a compromised identity provider, you've got two real options. Well, you've got three real options. One is do nothing and just bury your head in the sand and and hope hope it was just all a bad dream. Do not recommend that one. That's hope hope as a strategy is not a good one. So you can either opt to go, hey. Well, okay. We know that we know that the adversary has been in our systems. We don't know exactly when. We don't know what they've done. But we know that they weren't there three months ago. Okay. Cool. So we're gonna recover active directory. We're gonna recover Entra. We're gonna roll all of those things back, everything that's happened in that three months time three months period of time. And that can be useful. It can help you get back to a clean state, but then you have to think about all of the changes that have happened over that period of time. If you're in active directory, you're gonna be in a position where, oh, actually, yeah, all of your all of your computer accounts will reset their passwords. So you're gonna have to redo main join everything. If you think about all of the other actions that have taken place, you have people that have been onboarded. You've had people that have been off boarded. Going back and and performing that recovery is gonna basically make their accounts live again. So there's a whole bunch of things that you need to think about that, you know, you're very very much throwing away the baby with the bath water if you do that. The other way you can go about it is kinda go, okay. Well, we're gonna try and clean up what the adversary has done. We're gonna try and roll back those changes. And and that's very difficult as well because how do you have the confidence that you know everything that the, that the adversary is doing. So you have to make a choice of one of those three things. Again, I strongly recommend that you don't do the first one. None of them are particularly great options is all I would say. And this is a really good example of, you know, the kind of things that you we might see. So we see up here, we've got we've got an attacker who's managed to get in through an exposed identity. They've done all of the usual stuff. They move laterally. They escalate privileges. They make changes to group policies. You know, all of these things are happening. But at the same time, if we think about the other admins that are that are in your environment, the other things that are happening over that period, we don't know what this dwell time is. It could be ten minutes. It could be three weeks. We we we don't know. So there's there's a whole bunch of changes that happen there. Now at this point, what we've got is you're you're you're effectively locked out. Your your systems potentially are down or at the very least can't cannot be trusted. And actually, that might be worse than all systems don't. So the adversary goes, they do what they need to do. They install malware. They maybe maybe even use DFS to replicate that malware across active directory, for example. They can then, you know, as as I mentioned, they they can leverage on for connect things like skeleton key to to get into your on for a tenant, and basically do all of the bad stuff. Sometimes what they'll do is they will then, you know, just just as a final, hey, We were here. They'll encrypt all of your your domain controllers. So when that happens, you are at a point where, okay, everything everything is down. And now you need to kind of figure out, what do I do here? Over on the right hand side, we have some dollar bills. You could as you can imagine, once everything's down, it becomes, you know, you're you're losing money hand over fist. If you're if you're in a public sector organization, if you think about things like, you know, if if you're if you're working in health care, for example, there there's potential, you know, risk risk to life in these situations. So it's not just it's not just about the dollars. But when it comes to figuring out what you need to do, you know, you there's a there's a whole bunch of processes you need to do. So you need to decide what point in time you're gonna recover to, and then so you you're gonna perform what we call active directory forest recovery. So you go through all of that process. That is not fun. It can be done. The documentation is there, but, you know, dependent on if if you do have Entre in your environment, the next thing you need to do is you need to resync Entre back from your restored active directory forest. One of the challenges you've got here is there's a thing within Entre Connect called the metaverse database, and that is the thing that store that that tracks state essentially. So when you roll back active directory, if you try to do a once you re onboard into Entre, once you settle the Entre Connect link, by default, what's gonna happen is it's gonna perform a full synchronization because you have a brand new Entre Connect service, system set up there. That full active that full synchronization process can take four, five. It can take it can take a long time. It can be days. In some cases, in very large organizations, it can be weeks. And this is not a thing that you wanna be waiting for because all of that time, people can't access the rent m three sixty five. All of the other stuff that you have that's hooked up to, to to those on for accounts, for provisioning for access, all of it is effectively down. And there's nothing you can do to speed that up. There's no way to go. Well, I want I need these people to be able to log in immediately, and then maybe, you know, the reception people, they can they can wait a little bit longer. So you go through all of that process. You also need to think about, hey. How do I validate that that recovery point that I have selected actually was safe? Are you doing that before you perform the recovery, or are you gonna do that you know, redo your recovery into a sandbox, run some kinds of scans? And, again, when we're talking about identity, you know, it's it's much more difficult. You you can't install an EDR a piece of EDR software with a bunch of identity IOCs and just go, well, that's that's not compromised anymore. It's all of the actions. It's everything that's that's taken place within the IDP. So just figuring out where that clean point in time is, what stuff you're prepared to throw away, and all of this, what is a very stressful time. So I would recommend, if nothing else, go through a tabletop exercise and figure out how you would do this without without any any of the tooling that, that Joanne's gonna show you shortly. And speaking of tooling, so identity resilience, this is, this is a product that we we launched just over a year ago at this point. Really, as I've been trying to drill home to you, identity really is, you know, it's the it's the control plan. It's the front door, into your enterprise. So you need to make sure you can keep things up and running. You need to make sure that you've, you know, managed the, the potential attack surface, that you've minimized any any potential weaknesses, vulnerabilities in there, and you need to be able to recover those identity services quickly and cleanly. And cleanly is really important. If you can stand things up very quickly, but you've got no confidence that they're in a safe state, you're just gonna be going round and round and round in circles until you do find something that you have confidence in. And trust is a really important thing here as well. So yeah. Again, identity system system is a critical infrastructure. So we're giving you the ability to detect risks as they're happening, to maintain that continuity, and to recover clean from a single platform, across all of your IDPs. And really, how we do this, we have we have three core pillars to, to how we approach this. The first one is the security and governance side of things. So this is all about making sure that you're minimizing that attack surface, that you're reducing any any potential ways in that an attacker could could find. You know, one of the key areas there is things like identity hygiene, passwords, secrets being rotated, all of that kind of stuff. But also, you know, just making sure that you are compliant with any governance standards that you need to meet as well. The next one is from, like an operational stability perspective. So if we think about all of the changes that happen day by day, most of the people that are driving your, your identity infrastructure are gonna be humans. Some of them might be might be might be agents. I'm I'm I'm not sure. It depends on on your environment. But the vast majority are gonna be humans, and humans make mistakes. So, you know, wherever there is human error, you need a way to be able to identify those changes and roll them back. So a nice a nice easy rewind undo button. However you wanna think about that. And then the third really is, for that kind of scorched earth scenario. Hey. Everything everything has gone down or I've I've fully lost trust in my identity infrastructure. How do I perform that clean cyber recovery? And again, Rubik does this across active directory, on for Okta, and across human and nonhuman identity. And really, as as I mentioned, the the the core part here is knowing what clean is. So we can ingest, signals from a bunch of, a bunch a bunch of other tooling things like, CrowdStrike identity security and Microsoft Defender for identity. So we can we can actually ingest the signal from there as well as from your IDPs. We can use these to to help identify where bad things are happening. We can look at things like failed logins, changes to privileges, change and and we're we're tracking all of this stuff as well. So whenever there's a change to your identity provider, we keep we keep a log of all of this activity. And this is really important because, otherwise, you might find yourself in a situation where, hey. I need to do some I need to dig through some audit logs in active directory, but, you know, if a threat actor can compromise your domain controller, they can clear those logs as well. So unless you have them somewhere else, that becomes very, very tricky. And all of this other stuff. So things like secrets for NHIs being rotated, generally, the monitoring of your organization. So once we know what's happening within the organization, we can now see how things change over time as well. So we can do do something, like configuration drift analysis. And also we can help kind of filter these things so we know, you know, we've got some idea what what is likely to be good, what is likely to be less so. And then finally, once we found those changes, once we've identified those bad changes, we can start rolling back. We can start surgically removing, those those changes in there, correcting access permissions. All all of that good stuff. And as I mentioned, I've kind of probably covered most about this, on the previous slide, but we have those integrations there with CrowdStrike and Defender. We what we do is we take the signals from those systems, we then apply our own intelligence. So we correlate the action. So for example, if a threat actor, generates an alert in CrowdStrike, we will ingest that alert and we can then correlate that. So we can give you very, very quickly a list of here's all of the actions that that threat act has taken, in this specific time frame. We don't just do that. We can show you how to roll it back as well. I'm sure I'm sure Anne's gonna cover all of that stuff. But also really, really important here is is the fact that we have these immutable backups. So, by all means, you know, there there are very different systems dependent on which which IDPs you're using. So for example, a lot of organizations, that using Okta for example, they'll use something like Terraform to make changes to, make changes to the IDP. And also they they can you can you can kind of download configs download backups of activities that use using Terraform. Now that might work for you, but when it comes to recovering any change that's happened, it's it's it's very, very manual. So, having having backups that are stored somewhere where they can't be tampered with but also being able to easily recover from them. And then, again, over on the right hand side there, we're really looking to drive clean recovery. So I'm not gonna read all of that stuff out for you, but the whole idea being one platform, active directory, Ontra ID, Okta, get yourself back to a clean state. And on that note, I'm gonna hand the screen across to Ant, and, I will shut up. So thank you very much for your time. Thanks very much, Kev. So what I'll do is get my screen shared here. She should be able to see the Rubrik Security Cloud dashboard. This specific view is absolutely everything relating to identity. So the topics that Kev's already covered in regards to the identity posture management and the recovery side of things as well is, contained within this this platform. Just on top of what Kent was saying earlier regards to the security of the data that you're obviously finding, you know, the the need to protect and identity is obviously a key point of that. The the important piece that I think just to drive home from a procure the the security cloud perspective is that we're not looking to have, systems operating systems, deployed underneath this to support the capability like Kev said earlier. When you're completely down, for example, and you don't have access to a server and operating system and the applications and databases that support your identity protection, as well as provide the visibility in terms of those investigations, you need something you're gonna be able to use to drive that. So the security cloud piece is is key to that. This is very much, as I said, quite quite a busy dashboard, but hope you can see here, as Kev said earlier, you know, the identity environment's typically quite large, being changed quite significantly, for specifically the large organizations. This gives you the the overall view in terms of top actors, the actions they're taking in your IDPs across Okta, a AD, Entra. And and at the bottom here, you can start to see some of the site the the summary of the violations and and policies, which I'll come to in a in a bit later on as we go through this. So summary overview and the protection status of those platforms that we've got from an IDP perspective to start with. Not gonna go through absolutely everything as it relates to our functionality that take will take quite some time, but this will hopefully give you a a good appraisal and overview of of the capabilities that we have within the in the platform itself. The first of those was speaking to to what Kev was speaking to earlier is that having something which you can, really be operationally effective, with regards to recovering a active directory. So as you can see here, this is the active directory forest recovery view. Now what I didn't say when I introduced myself at the beginning of the call, I, you know, I used to have a proper job. I've been lucky or unlucky enough to have to go through the the the the, the Microsoft, stage by stage steps that required to recover ID. And I like like Kev was saying, when you're doing that under pressure, that can actually be pretty error prone, especially if you're, as I said, having to do that to under duress a, an unfortunate side of the, you know, an unfortunate side of your working hours. So from our from our perspective, as you can see here, this ADFR forest tracker, this, first of all, allows you to do it when under duress, but most importantly, will allow you to test this when you need to validate the fact that you'll have a platform in place that you can recover active directory from. So knowing how you get back to that good point, we have built into the platform, the the Google threat intelligence feed. So that will also help support your investigative standpoint in terms of knowing what good looks like. So when was the threat actor in my environment? When have I identified an IOC that could be something like, for example? Okay. Well, I know when not to go back to, so let's start thinking about when the good time to go back to is. And so I'm not gonna read this out line by line, but you can see here that this absolute absolutely will align to those best practices that Microsoft published on their website about all the pieces and processes that are related to being able to recover, an active directory environment into the entirety, including as you see here, the forest, the root domain, and then the subdomains underneath it. So, again, very predictable, entirely very entirely straightforward to test. And, again, you don't necessarily have to be wedded to the the the security cloud interface to do this. You could use the APIs to further automate your testing if that was something that you wanted to do. So that's that's, I said, what the ADFR process looks like, in terms of how you drive that from the the Rubik's security cloud, and that's just the recover forest button there. We also have operations that you could do at a DC level as well. Moving on from that, if I go back to the the, screen with my, Entra, sort of thing. So if I go to Microsoft Entra ID here, at the same time, once I've got the, those tenants, allocated and registered with my Rubik's Security Cloud. You can see here, we have two registered. We can see our SLA domain. So I could be using an SLA domain that is entirely tied to identity. So a single SLA domain for on prem AD as well as entry itself. I can then click into the, the the the the the the the density dashboard for the the backups we have here, and I can then go through, identifying a recovery point I wanna get back to. And if I go if I step through this, what you can see here, I've got the options just in the same way that I'd have the ability if I wanted to to recover a group policy for, on prem active directory. I could have granular recovery for things like conditional access policies, users, groups, roles, named locations, that kind of thing. At the same time, I also got the capability in the same way I can run ADFR to be able to tie that to running a an entry level recovery. So by check by going through this particular part of the process, I get the capability to get back to the original directory that I've backed up. Alternatively, like I was saying earlier, if we find that your entry ID environment is either locked down for investigation, or you, you know, simply can't get into it, having something which you can move to is going to be really valuable when you start to think about getting that minimum viable business back up and running to support all those users, the enterprise applications, for example, that are part of Entra to be able to, again, as I get your business up and running in that minimum state. So this cross tenant recovery is something that you also facilitate as part of the, the platform as well. So whilst I'm running that recovery, there may be certain things that I don't want to roll back, and bring back into the environment that could be either maliciously or accidentally created objects that caused some serious issue. So I can actually send start to think about what I don't want to recover, and that could be from users. It could be particular enterprise apps or app registrations. Again, I'm gonna go through this, to, to just kind of walk you through that what that process looks like end to end. On top of that, in addition to being able to have that capability, it's important when you are recovering, potentially even into a Brownfield tenant, for example, versus a brand new tenant, is to have really good conflict resolution to help minimize the overall level of effort. That you're going to be, you know, having to I think to put into that recovery operation. So we can, as I said, overwrite everything, preserve settings required, or simply skip existing objects if we think that there's something worth, avoiding there. So once I get to that particular piece, I then click recover, and then that's gonna again run that recovery process, into that new tenant there. So that that hopefully gives you some flavor of what that looks like from a forest level recovery perspective as well as an entry ID, side of things as well. And at the same time, I'm not gonna go through Okta as well because it's constant time. But as you can see here, the look and feel and the presentation is is that is is entirely consistent, so easy to adopt from an administrative standpoint. Moving forward from recovery, if I go to the excuse me. The, the identities side of things here. So if you see in in the UI, what we have within the, Rubik's security cloud is the view of not only the the the user identities I have within the platform that we've that we've brought in for active directory, for Entra, for Okta, but also identification of machine accounts themselves. And as well as that, we're also tracking, like Kev said earlier, things for configuration drift. So you can see here things like GPOs, conditional access policies are also being tracked within the platform. If I so taking this a step further to take, a look at like I was saying earlier, something where potentially do want to start getting insights into what is going on within your identities. If I look at this particular account here, for example, just to kind of demonstrate, the this is the if you like, the end to end view of a particular identity bringing together that insight in terms of not only the alerts that this potential, identity board have generated, but also the violations that they they have. Now this could be something where an account has been compromised and has then been matched to a violation, Or it could be that you've got Rubik's security cloud up and running and pointed at your identity environment already, and you need some, let's just say, visibility if you like in terms of being able to help prioritize what the things you wanna focus on. If I look at the the policy violations here for this particular account, what you can see here that there are four violations ranging from from critical to low. And those violations are essentially built, into the Rubik's Security Cloud itself. So if we look at, this delegation enabled for, 80 privileged identities, the Rubik's Security Cloud is, aligning or helping line to those that governance and that framework side of things. So as you can see there, things like the MITRE ATT and CK framework, ISO 27,001 are being identified and allocated to that policy. So through that policy engine and the evaluator that we have built into the platform, you are then able to highlight the vulnerabilities and the indications of exposure. So we normalize that identity data. So if we take that, we can protect that and then row and run that against, the codified rules that we have, within the platform itself. And there are as I said, there are, you know, there's a couple of policy types. So there's policy types, relating to identity. So whether that be, the nonhuman accounts, the user accounts, and that's kind of security at individual level individual level, if you like. There's the ITP high level, misconfiguration that we can help identify whereby potentially have too many users, for example, in, you know, groups with high levels of privileged identity. And then finally, as you can see within this particular view here is that, in the in the SVC account, if I go back to that, we're also going to be mapping that to, the the the data itself. So when we are protecting that data, we can actually expose the act the data that account has the sensitivity. Now prior to being with Rubrik, I spent three and a half years in the MDR space. And when you are under duress and having to recover identity environment, also you're having to ask answer the questions about, okay. So what what what potentially has happened to that account and what did it have access to? So that second question around, helping drive those investigations forward in a in a meaningful amount of time is is obviously really important as well. So that's, that's the view there. So I'll go back to that to this delegation view. As Kev said, is you could also, through the Rubik's security cloud, either as part of a a workflow that you might already have established as part of your organization's, workflows, some integrations with ITSM systems, you can create a ticket, and then drive up through that type of process. Or if you really wanted to, you could actually drive these types of remediation workflows directly through, the Rubik's security cloud itself. So that's a little bit about how the the policies and violations service surface themselves, in the, in the platform itself as well. Moving, on from the, the the policies and violations, what I'm going to do is just give you some insight in terms of, like Kev said earlier, the ability for us to have a holistic view of the logs. So part and parcel of the platform is to helping support organizations that, want to bring those logs into our platform. And one of the main reasons for that would be the fact that threat actors know, like Kev said earlier, when they want to do the DC shadow attack, they wanna get in and out. At the same time, is they want to, remove the ability for you to go and track and trace through logs. So having a tamper proof air gapped location for your logs through the reboot security cloud not only helps assist with operational level side of things in terms of knowing what's happened when a user's logged in or a member's been changed to a group, it's actually having something to be able to rely upon to go back out to, and support an investigation. So the activity log, itself, as you can see here, there's quite a lot of surface information here. If this Ryan Garrett, for example, wants to investigate this particular type of, of activity, What as you can see here, we're surfacing what's happened through that active directory membership. Not only it's about not even necessarily, it's all about cybersecurity and helping you respond to those instances instances. It's also about helping that operational element as well. So knowing how to revert a change is also key to be able to do that. And, again, as you can see here, that's really straightforward for me to drive through. I want to go and check that progress in that in that revert operation. That's something I can do as well. As well as those activity logs, as you can see here, we're also capturing the sign in logs. So, again, that's across Active Directory, Entra, and also Okta. As you can see here, this particular user is logging in to the Okta platform, tracking that location where that's come from all of details, low level information such as the session ID, and other elements of that from a metadata standpoint. So that's the that's the kind of log side of things, but if we really want to get into the, you know, some of the other, for one of the better way of putting it, really cool features will be, like, helping support those pieces where you need to respond to things from a kind of threat perspective and alert perspective. So, if we want to look at, something like a GPO modification being modified and even added in some respects, this gives you, the the ability for you to be able to go and expedite that and run that investigation through the through the platform itself. So in the same way that we, have the capability, like I showed earlier, through that delegation, privilege, a kind of, issue, we also have the view because we own the state of the IDP from the backup that we took to be able to run the compare and contrast. So as you can see here, this particular Sys, GPO has had a modification made to it. We need we can then go and investigate what the unseen, sorry, the four changes that have been made to that GPO. And then this is the supporting information relating to the act that made that change, and and other elements that would be important from an investigative standpoint to that such as as it said here, investigating that change. And in the same way as I showed earlier, we then get the ability if you would like to roll back those changes or create a ticket at the same time. It's not just about the the alerts that Rubik themselves can surface though. So if we, go back to this main alerts page, as Kev was saying earlier, we also have capability to surface other types of alerts put in the platform itself. So if you want to look at specific, alerts that come from, CrowdStrike, Absolutely. You can see that that's been surfaced in the platform as well, such as, suspicious LDAP searches being conducted, for example. And at the same time, if we then want to take a look at this from a lens of a Microsoft Defender for identity standpoint, you can also see here that we are bringing those in as well. So, again, it it's not necessarily about being just able to see the alert. Like Kev was saying earlier, it's about the ability for you to be able to track through what has changed when that alert comes in from Defender for identity, for example. So we can see use we use modifications, for example, use being moved removed from groups, the corresponding micro attack framework tactic being used. And if we go into this, particular piece here, what we can also see if we scroll down is the actual details surrounding this particular part of all of that event tracking, if you like, that came from Defender for Identity itself. So whilst I've got a singular action to revert here, what I could also do is go back to the the main view for Defender for Identity and actually unpick any and all of the pieces that I wanted to change, go to the revert section, choose the DC that I want to operate that on, and click next. Click revert, and that that will then handle that process, in its entirety. Again, I'm not gonna go through every single option here, but you can see what it surfaces and we correlate against in the platform, is, is key to helping track that through in terms of the actors that made the change as well as the target entities, as you can see here, that were were affected by that. That's pretty sweet. Well, yes. Like I said, Kevin, it's like, you know, it's it's in the platform. It's not just a slide. Curses burned by my old petard. I'm gonna wrap things up. Just from a reporting standpoint, you know, at the same time, as well as your forest recoveries, your enter IDs, all of that can be tracked in order to report in reported on. What we also have within this particular piece here, just as an example, is the, the identity activity report itself. This is where you could have that consolidated view. You can bring that together not only from the twenty four hours, but whatever it is from an audit standpoint you want to build that report out. It could be the last week, for example. You can start to track that through, save that out, and then present that, to your the teams that may be interested in going through that information as well. And you you can automate that reporting. Right? Well, that that you can automate it within, yeah, the RSC itself. Sure. You could you could build that on a a scheduled basis. Like I said to you before and I said, we're not, so that's security cloud's built there to be easy and accessible. If you wanted to bring that out as a through the API calls themselves, and that's something that actually could you could take elsewhere and put alongside your other reports to be quite as well. Love it. Awesome. Thank you so much, Ant. You're welcome, Kev. Okay. I have got a few more slides. So, yeah. Hopefully, people will stick around for these. There we go. Okay. Cool. So we've done the demo. That's all good. Awesome. As the the demos are always the best part best part of these things. So thanks so much for doing an amazing job there. So I just wanna kind of bring things, just kind of summarize what we've what we've covered off here today. So, first things first, you need to have immutable backups of your identity systems. If your if your backups can be tampered with, if they can be accessed over a network and deleted, they're not gonna be any use to you when it comes to, that kind of worst case scorched earth scenario. You're gonna need some some kind of orchestration there as well. So something that can handle the recovery of all of your IDPs, whether you're just in on Okta or, you know, you've you've got a mix of various different things. You really need to have a single platform that can orchestrate all of that stuff. And also do, you know, they they can do the monitoring in that same same platform as well. So we know that, as as as as organizations grow in complexity, the number of tools that their teams have to manage is always always increasing as well. And we're not trying to do everything, you know, as as as I'm sure, you know, we have those integrations with, with CrowdStrike and with Microsoft Defender for identity. So we know that what they do, they do really, really well. We're not we're not looking to compete there. What we're doing is we're making what they do better and closing that gap between a detection response and recovery. So that helps from, you know, when when we start talking about the changes that are happening as well. So just having something that's out of band of your IDP itself that can show you, hey, this is how, this is this is potentially how a threat actor gained access and then these are the things that they did whilst they have the access. Super super important. And also from a reporting capability as well. And then finally, that ability to surgically re remove bad actions without impacting on good. So the idea being that, you know, you really do just need to cut out the changes that a threat actor has made so you can make sure that they don't have assistance in the environment. And so you're not just recovering to a state where, you know, they can just log straight back in again. Something that gets thrown around, quite a lot in the industry is, you know, this idea that Rubrik is new to the identity game. We've been we've been protecting identity sources for years now. We've got over 3,000 customers globally. It's a few of them, just popped up on the screen. But, yeah, we've been doing identity for a long time. We've just been extending into the resilience space now. And, you know, I think we're really pioneering what's happening out there. Finally, just to wrap up, I just wanna say a big thank you from from myself and from Ant. If you would like to get a little bit more hands on with, you know, with with the product as Ant was showing you earlier, You can go to www.rubric.com/explore/demo. There's, I think, something in the region of about a 100 different demos that are in there that you can click through. You don't need to install any software. It's just you just it's just a website you go to. It's a really good way to get hands on with the product and, you know, get a feel for the capabilities. But yeah. Other than that, thank you once again for your time. We hope to see you again on the next Rubik webinar. Thank you. Thank you.