tier-zero-audit

Audit Tier Zero membership via Bloodhound Enterprise API calls to enumerate inclusion selectors, validate certification status, and identify unvetted additions like stale service accounts or misclassified groups creating unmonitored attack paths.

Tier Zero access drift occurs when unvalidated changes add unvetted principals to critical asset groups, creating unmonitored attack paths. This increases organizational breach risk by allowing stale accounts into high-privilege access positions.

Yes, auditing Tier Zero members generates certification recommendations for legitimate principals while flagging drift for human-approved revocation, tracking changes by reviewing full audit logs via Bloodhound Enterprise API calls.

Perform a Tier Zero audit to enumerate members and catch legacy computer objects incorrectly added during migration, while validating new service accounts requiring domain controller admin access and reviewing recent change history.

Yes, the audit reviews recent change history and full audit logs for Tier Zero asset group inclusions. This validates selector logic, tracks modifications, and flags unvetted additions for human-approved revocation.