Compromised User Report

One of Enzoic's newest reporting options as of version 3.5 the Compromised User Report now provides administrators the ability to instantly view, remediation, and notify compromised users in their environment at any time while a user is considered compromised.

This feature is particularly useful for those Admins running Enzoic in a Notification Only mode. Being able to have a single pane of glass tool to see when the user was compromised, what action was taken at that time, who was notified, and then immediately force a password change or disable the account has been a much requested feature.

We understand our customer's environments aren't static and neither are their needs. We have seen more than once a case where an Admin moves a user between policies in Enzoic and expects a specific remediation to have occurred when in fact the remediation was already applied from the first policy they were associated with at the time of compromise. Not only does the new compromised user report show you the original policy applied as well as the original action taken, it also provides you the ability to see the status of that remediation and the option to override it with one of your own.

Remediations can be performed from either the main report screen by selecting one or more users and then selecting the desired remediation option at the bottom of the screen or from the detailed view by selecting the 'more info' link in the last column of the report. This button will bring up the compromise details view of the user which will list a timeline of events in the history of this users compromise status.

Admins will have the ability to notify the end users by email (if an email is present in Active Directory). Note that while Notification only is listed as a remediation option in continuous monitoring settings, it is NOT considered a remediation in terms of a compromised user.

Like with all of Enzoic reports, you will need to click 'Refresh' in order to see the latest information as Enzoic does not automatically refresh these in the background.