Visão Geral

Este curso apresenta os fundamentos de auditoria de segurança em ambientes Windows e Active Directory. O participante aprenderá a estruturar políticas de auditoria, coletar evidências, analisar atividades administrativas, monitorar alterações e utilizar logs para investigação e conformidade.

Objetivo

Após realizar este curso, você será capaz de:

• Configurar políticas de auditoria
• Coletar e analisar evidências
• Monitorar atividades administrativas
• Identificar eventos suspeitos
• Apoiar processos de conformidade

Publico Alvo

• Administradores Windows
• Analistas de Cybersecurity
• Analistas de SOC
• Auditores de segurança
• Profissionais de infraestrutura

Pre-Requisitos

• Conhecimentos de Windows
• Familiaridade com Active Directory
• Noções de Group Policy
• Conhecimentos básicos de segurança da informação
• Familiaridade com Event Logs é recomendada

Conteúdo Programatico

Module 1: Windows Auditing Fundamentals

1. Security auditing concepts
2. Audit policies
3. Security events
4. Audit categories
5. Success and failure auditing
6. Security event generation
7. Windows auditing architecture
8. Audit data sources
9. Evidence collection
10. Audit lifecycle

Module 2: Advanced Audit Policy

1. Advanced Audit Policy concepts
2. Account logon auditing
3. Account management auditing
4. Logon and logoff auditing
5. Object access auditing
6. Policy change auditing
7. Privilege use auditing
8. System event auditing
9. Detailed tracking
10. Audit policy configuration

Module 3: Active Directory Auditing

1. User account changes
2. Group membership changes
3. Privileged group changes
4. Computer account changes
5. Organizational Unit changes
6. GPO changes
7. Directory object access
8. Domain Controller auditing
9. Replication-related auditing
10. Active Directory audit governance

Module 4: Privileged Activity Auditing

1. Administrative logons
2. Privileged account usage
3. Security group changes
4. Policy modifications
5. Remote administration
6. PowerShell activity
7. Process creation
8. Service changes
9. Administrative session monitoring
10. Privileged activity analysis

Module 5: Audit Analysis and Investigation

1. Event correlation
2. Timeline reconstruction
3. User activity analysis
4. Host activity analysis
5. Authentication analysis
6. Suspicious behavior identification
7. Evidence preservation
8. Incident investigation
9. Threat hunting
10. Audit reporting

Module 6: Practical Auditing Implementation

1. Audit policy design
2. Group Policy configuration
3. Active Directory auditing
4. Privileged activity monitoring
5. Event collection
6. Event analysis
7. Security investigation
8. Audit validation
9. Compliance assessment
10. Practical Windows auditing cases