> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/introduction/forestall.md). # Forestall ISPM - Identity Security Posture Management Disrupt the adversaries' identity kill chain across on-premises and cloud
Forestall logo
`Forestall ISPM` reveals your organization's identity security posture before the attacker does, and helps you take the necessary precautions with on-demand or scheduled assessments. It analyzes Active Directory and four cloud and SaaS providers in one product: | Provider | What is analyzed | | -------------------- | ------------------------------------------------------------------------------------------------- | | **Active Directory** | Forests, domains, users, computers, groups, GPOs, AD Certificate Services, local accounts, shares | | **Azure** | Entra ID, Azure Resource Management, Microsoft Teams and SharePoint Online | | **AWS** | IAM, Organizations and IAM Identity Center | | **GCP** | Google Cloud IAM, projects and resources, and Google Workspace | | **GitHub** | Enterprises, organizations, organization roles, users, teams, repositories and app installations | ## Identity Inventory Forestall collects in-depth information about the objects of each provider and the relationships between them. Some of the analyzed Active Directory objects are: * Users * Computers * Groups * Group Policy Objects * Organizational Units * Service Accounts / Managed Service Accounts (MSA, gMSA, dMSA) * Service Principal Names * Access Control Entries * Local Groups * Local Users * Network Shares Objects from all providers are listed under [Unified Identities](/forestall/unified-identities.md) in **Human Identities**, **Non Human Identities**, **Resources** and **Group** views. Identities that belong to the same person, such as an AD user and its synchronized Entra ID account, are correlated into a single unified identity by configurable [merge rules](/forestall/settings/merge-rule-settings.md). Every object can be filtered, exported and queried with [Search & Reports](/forestall/search-and-reports.md). For example, you can list: * Privileged users and groups * Disabled/locked users * Service users * Organizational Units with no members * Users with local administrator privileges * Computers/users with most sessions * Group Policies with no linked entities ## Vulnerability Assessment Forestall detects provider-specific vulnerabilities and misconfigurations with its Vulnerability Detection Engine. Each finding is an **issue** with an ID that starts with the provider's block: FS1xxx for Active Directory, FS2xxx for Entra ID and Azure, FS3xxx for Teams and SharePoint, FS4xxx for AWS, FS5xxx for GCP and FS6xxx for GitHub. Custom tags are added to issues for easier categorization. Issue documentation in the product contains the information below to accelerate identification, remediation, detection, and prioritization. * Severity, Ease of Mitigation and Ease of Detection metrics for prioritization * Issue description, impact, and references * Manual identification methods * Detailed mitigation plans and scripts for automated remediation * Exploitation detection methods with event log IDs and attributes * MITRE ATT\&CK matrix mapping for suitable issues * Mapping to twelve compliance frameworks on the [Compliance](/forestall/compliance.md) page After fixing an issue, a [Remediation Scan](/forestall/issues.md#remediation-scan) re-checks only the selected findings instead of running a full scan. ## Actionable Remediation Roadmaps against Impacts Forestall generates a remediation roadmap by aggregating the issues that create critical attack vectors under [Impacts](/forestall/impacts.md) and reveals which attacks the organization can be affected by. You can then act on whole attacks and emerging identity threats, not only on single issues. ## Identity Security Graph When the scan is finished, Forestall builds a security graph of all collected objects and their relationships, including relationships that cross from Active Directory to the cloud. Use manual or built-in queries in the [Graph](/forestall/visualize.md) to find abnormal relationships, shortest lateral movement and privilege escalation paths, Shadow Admins and misconfigured access control entries. [Tier0 Analysis](/forestall/visualize.md) shows which objects can reach Tier 0. Some of the built-in queries in the Graph module: * Objects with DCSync rights * Non-built-in admin objects with WriteDACL rights * Administrator sessions to non-Domain Controllers * Groups with local administrator rights * Shortest path to admin groups * Abnormal rights which Domain Users should not have ## Focused Audits * [GPO Audit](/forestall/gpo-audit.md): Group Policy analysis, baselines and RSoP comparison. * [CAP Audit](/forestall/cap-audit.md): Entra ID Conditional Access Policy gap analysis, ineffective and duplicate policies. * [Credential Discovery](/forestall/credential-discovery.md): secrets found in SMB shares. * [Trend Insights](/forestall/trend-insights.md): how risk and findings change across scans. ## Reporting When a scan is finished, Forestall generates an **Executive Summary (PDF)**, a **Full Report (PDF)** and an offline **Report Package (ZIP)** with the report and its affected-object evidence. Branding, cover page and executive summary are set in [Report](/forestall/settings/report.md) settings, and reports can be regenerated from the scan list. ## AI Assistant and REST API The [AI Assistant](/forestall/ai-assistant.md) answers questions about Forestall and your scan data in natural language, using a cloud or self-hosted AI provider that you configure. Forestall provides a REST API for automation and extensibility, and an MCP server for AI clients. See [API Reference](/forestall/api-reference.md) and [API Tokens](/forestall/profile-menu/api-tokens.md). ## Deployment Forestall is installed on a single Windows server in your network and needs no agents. Active Directory is scanned directly from that server. Cloud providers are scanned through their APIs, which requires outbound HTTPS access. See [Architecture](/forestall/introduction/architecture.md) and [Requirements](/forestall/introduction/requirements.md).