> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management.md).

# Improve Active Directory posture with AD-SPM

{% hint style="success" %}

### Prerequisites

* ITDR add-on
* **View** or **View/Edit** RBAC permissions for **Identity Runtime Security**
  {% endhint %}

Active Directory Security Posture Management (AD-SPM) scans your infrastructure against known misconfiguration patterns, and weak and compromised passwords, to detect security vulnerabilities and provide specific remediation guidance.

To enable AD-SPM, toggle the AD-SPM setting in the Identity profile of the agent. To see how to configure the Identity profile, see [Set up Identity Profiles](/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr.md#set-up-identity-profiles).

### **Explore AD identities**

AD-SPM discovers the following on-premises identity types:

* Human identities
* Non-human identities
* Groups
* Policies

### **Review and manage AD posture detection rules**

Monitor your organization’s detected AD misconfigurations and weak passwords in **Modules** → **Identity Security** → **Detection Rules** → **Posture.**

AD-SPM provides a comprehensive list of about 150 detection rules. Filter the **Provider** field for **Active Directory** to see the detection rules that apply to identities. Following are a few examples of these rules:

* Dangerous ACLs on AD certificate container
* Privileged user with a password that never expires
* Non-privileged users can set Server Trust Account

On this page you can do the following:

* Use the widgets to view your identity rules, identify top issues, and view impact by asset type.
* Click each rule in the table to open a side panel where you can see the rule details, remediation suggestions, and compliance controls. This panel also displays the XQL query used to generate the issue. You can customize it or copy it to use it in the XQL Query editor.
* Create a new rule. Cortex provides default rules for managing your cloud posture. To add more customized rules, click **Create Rule**, select **Identity**. For more information, see [Create a custom detection rule in Cortex Cloud Identity Security.](/cortex-xsiam/cloud-security/cortex-cloud-identity-security/create-a-custom-detection-rule-in-cortex-cloud-identity-security.md)

### Investigate AD misconfigurations

To review the AD misconfigurations in your organization and investigate the issues related to them, navigate to **Modules** → **Identity Security** → **Identity Asset Inventory → All Identity Assets.** In the **On-premises Identities** tab, filter the table using the following types to see the details about risky identities:

* AD Generic Principle
* AD Group
* AD Machine Account
* AD Service Account
* AD User

Filter according to the **Weak/Compromised Password** to see the accounts at risk for unauthorized access and credential exploitation.\
Each identity displays the number and severity of the issues triggered by the module.\
To investigate the issues do one of the following:

1. Click the identity to see its side panel. From this panel, click the number of issues to open up the issues table.
2. In **Modules** → **Identity Security** → **Issues** → **Posture,** select an issue.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.