Tenacy offers the ADS - Oradad connector.
This connector pulls several types of information:
Indicators on the AD: number of users, machines, domain controllers, and administrator accounts
Indicators on the security level of the AD: overall ADS score, number of alerts, warnings, and information: global and by ADS level, overall progress and by ADS level.
Vulnerabilities as Gaps in Tenacy: vulnerability name, criticality (based on ADS Grade), description, and recommendation.
Adding and configuring the connector
To add this connector, go to Catalog > Connectors > ADS Oradad > Add a connector.
After adding, you need to configure:
Operator perimeter: the perimeter that operates and dictates the AD hardening rules to which the indicators and metrics will be attached by default.
Frequency: Frequency of importing ADS JSON files and frequency of indicators. We recommend a monthly frequency, as ADS reports are produced monthly by ANSSI.
⚠️ When instantiating this connector, the Identity Management system measure (TE039) will automatically be applied to the operator perimeter if it hasn't been applied already.
After creation, you can add the gap register related to the creation of your gaps during the execution of the JSON file, as well as the maximum number of gaps to be processed during the connector execution.
You can also add consumer perimeters for the connector.
💡 However, we advise you to have one connector per perimeter.
⚠️ Maximum number of gaps: Only if you want to limit the creation of gaps to a certain number, this value cannot exceed 100. If left empty, Tenacy will synchronize the 100 (or fewer) most critical vulnerabilities (above the chosen threshold) identified by ADS as gaps.
Running your first test
Once the connector is properly configured, test the integration by running the first execution.
Go to ⚙️ > Connectors > Click on the ADS connector > Run now:
💡 Feel free to contact Tenacy support if you have any questions about this.
Connector operation
In the JSON file, the analysis_date field (or summary > date > v for older files) is used to associate the indicators with their correct production period, regardless of the import date. For a report produced in November with a monthly frequency, the extracted indicators will be linked to the previous complete period, i.e., October.
If reports are imported in an anachronistic order, the status of the gaps (open/closed) is not guaranteed, as the import of gaps relies on the execution date of the connector rather than the date in the JSON report.