Spotlight Process

1. Configure Connections and Data Sources

a. Set up connections:
i. Active Directory
ii. PAM
iii. SIEM
b. Define the assets and domains to be covered by Spotlight

2. Define Crown Jewels

a. Crown Jewels = any critical system
b. Must have an IP address, host name, or URL

3. Write Policies
a. Create a default rule to collect data
b. Create additional rules later if needed

4. Data Collection and Analysis

a. ITDR queries Active Directory and PAM
b. ITDR deploys self-dissolving binary to endpoints
c. Spotlight IDI server analyzes and prioritizes risk findings

5. Remediation
a. Spotlight performs cleaning based on auto-hygiene rules created
b. Spotlight administrators triage remaining risk findings