# CyberGuard Assessment Tool > Assess, monitor and improve the security of your Microsoft environment. CyberGuard Assessment Tool brings the security of Active Directory, Microsoft Entra and Microsoft 365 into a single portal. Assessments run automatically through agents and schedules, findings are scored and linked into attack paths, and Microsoft Defender data, compliance questionnaires and your team’s work all live next to the results. - **Active Directory**: Assess your on-premises domains with an agent that runs as a service: domain controllers, privileged accounts, policies, DNS and certificate services, with findings ranked by risk. - **Microsoft Entra**: Review identities, Conditional Access, roles and applications of your tenant directly from the portal, with Eagle Eye highlighting signs of attack on identities. - **Microsoft 365**: Check the configuration of Exchange Online, SharePoint, Teams, Intune and Defender to find the gaps in your collaboration environment. - **Security Score & Attack Paths**: One score for your whole environment, how it changes over time, and the attack paths that chain findings together, so you know what to fix first. - **Microsoft Security View**: See Microsoft Defender XDR incidents in full, the vulnerabilities attackers are actively exploiting on your devices, and run KQL queries on your Defender data without leaving the portal. - **Workspace**: Record activities, incidents, findings and KQL queries in one place, and keep track of what is open and what has been resolved. - **Agents & Scheduling**: Install agents and probes once, schedule assessments and receive email notifications: your environment is assessed automatically. - **Network Assessment**: A network probe discovers devices and exposed services in your networks and reports the vulnerabilities it finds. - **Compliance Assessments**: Guided questionnaires on security regulations, with the legal references behind each requirement and the official documentation at hand. ## Pages - [Getting Started](https://wiki.cyberguard.srl/cat/getting-started.md): CyberGuard Assessment Tool is a web portal that assesses the security of Microsoft environments — Active Directory, Microsoft Entra and Microsoft 365 — and keeps it under control over time.… - [Portal Reference](https://wiki.cyberguard.srl/cat/getting-started/portal.md): This page explains how the CyberGuard portal is organized: the navigation menu, the top bar and the elements you find on every page. - [Dashboard](https://wiki.cyberguard.srl/cat/getting-started/dashboard.md): The Dashboard is the first page you see after signing in. It tells you at a glance whether something needs your attention, how many assessments you have, and what is happening in the global threat… - [Threat Intelligence](https://wiki.cyberguard.srl/cat/getting-started/threat-intelligence.md): The Threat landscape section of the Dashboard shows global indicators collected from public threat intelligence sources. They help you prioritize your analysis, but they describe the threat… - [Microsoft Entra App](https://wiki.cyberguard.srl/cat/onboarding/entra-app.md): The Microsoft Entra and Microsoft 365 assessments read your tenant through an application registered in your own Microsoft Entra tenant: the Inside Technologies CyberGuard Assessment app. The… - [Assessment](https://wiki.cyberguard.srl/cat/assessment.md): The Assessment section of the menu groups everything CyberGuard knows about the security of your environment: one area per technology, plus the Security Score that puts them together. - [Security Score](https://wiki.cyberguard.srl/cat/assessment/security-score.md): The Security Score puts together the results of your Active Directory, Microsoft Entra and Microsoft 365 assessments. It answers three questions: how secure is each part of my environment, what… - [Attack Paths](https://wiki.cyberguard.srl/cat/assessment/security-score/attack-paths.md): A single finding rarely tells the whole story. Attackers chain weaknesses together: a service account with a weak password leads to a privileged ticket, which leads to the whole domain. The Attack… - [What Changed](https://wiki.cyberguard.srl/cat/assessment/security-score/what-changed.md): After you fix something, you want to know whether it worked — and whether something new has appeared in the meantime. The What changed tab of the Security Score compares two assessments of the… - [Active Directory](https://wiki.cyberguard.srl/cat/assessment/active-directory.md): The Active Directory assessment analyzes your on-premises domains: how they are built, how healthy the domain controllers are, which accounts and permissions put them at risk, and how well the… - [Microsoft Entra](https://wiki.cyberguard.srl/cat/assessment/microsoft-entra.md): The Microsoft Entra assessment analyzes your cloud identity tenant: users and groups, applications and their permissions, privileged roles, Conditional Access, and the signs that someone may… - [Eagle Eye](https://wiki.cyberguard.srl/cat/assessment/microsoft-entra/eagle-eye.md): Eagle Eye is a tab of the Microsoft Entra assessment that looks for signs that someone may already be abusing your identities. While the rest of the assessment checks how your tenant is… - [Microsoft 365](https://wiki.cyberguard.srl/cat/assessment/microsoft-365.md): The Microsoft 365 assessment analyzes how your collaboration environment is configured: mail, SharePoint and OneDrive sharing, Teams, data protection with Purview, devices managed with Intune,… - [Compliance Assessments](https://wiki.cyberguard.srl/cat/assessment/compliance.md): The technical assessments tell you how your systems are configured. Regulations ask a broader question: does your organization have the processes, roles and controls the law requires? Compliance… - [Microsoft Security View](https://wiki.cyberguard.srl/cat/microsoft-security-view.md): Microsoft Security View brings the data of Microsoft Defender into the CyberGuard portal, next to your assessments. Where the assessments tell you how your environment is configured, Microsoft… - [Vulnerabilities](https://wiki.cyberguard.srl/cat/microsoft-security-view/vulnerabilities.md): The Vulnerability Management tab of Microsoft Security View lists the software vulnerabilities that Microsoft Defender Vulnerability Management has found on your devices. To keep the list focused… - [Incidents](https://wiki.cyberguard.srl/cat/microsoft-security-view/incidents.md): The Incidents tab of Microsoft Security View shows the incidents and alerts of Microsoft Defender XDR and Microsoft Sentinel of the last 60 days. It helps you understand how far an attack has… - [Attack Chains](https://wiki.cyberguard.srl/cat/microsoft-security-view/attack-chains.md): An attack rarely produces a single incident. The same attacker can trigger an alert on a device, then a suspicious sign-in, then a change to a mailbox: Microsoft Defender XDR and Microsoft… - [KQL Queries](https://wiki.cyberguard.srl/cat/microsoft-security-view/kql.md): The KQL queries tab of Microsoft Security View lets you run Advanced Hunting queries on the data of Microsoft Defender directly from the CyberGuard portal, without switching to the Defender… - [Workspace](https://wiki.cyberguard.srl/cat/workspace.md): The Workspace is your team's logbook in CyberGuard. Assessments tell you what is wrong; the Workspace records what your team did about it: how an incident was handled, the notes of an… - [Internal Activities](https://wiki.cyberguard.srl/cat/workspace/internal-activities.md): An activity is a record of work: something that needs to be done, something that was done, how a problem was solved. Activities live in the Activities tab of the Workspace. - [Remediation Plan](https://wiki.cyberguard.srl/cat/workspace/remediation-plan.md): The Remediation plan tab of the Workspace turns the findings of your assessments into a plan: for every Critical and Warning finding of Active Directory, Microsoft Entra and Microsoft 365 it… - [KQL Repository](https://wiki.cyberguard.srl/cat/workspace/kql-repository.md): The Saved queries tab of the Workspace is your team's repository of KQL queries: the hunting and investigation queries you want to keep, share with your colleagues and run again when you need them. - [Networking](https://wiki.cyberguard.srl/cat/networking.md): The Network Assessment shows what the network probe finds in your networks: every device that answers, the services it exposes, the vulnerabilities that affect it and the risk it represents. It… - [CVE](https://wiki.cyberguard.srl/cat/networking/cve.md): Network devices — firewalls, switches, access points, NAS, printers — run a firmware that, like any software, can contain vulnerabilities. Unlike servers and PCs, they are rarely covered by an… - [Ports](https://wiki.cyberguard.srl/cat/networking/ports.md): Every open port is a door into a device. Some must be open, but many are left open by default, expose management interfaces in clear text, or use protocols and certificates that are no longer… - [Network Probe](https://wiki.cyberguard.srl/cat/networking/network-probe.md): The network probe scans the networks of your organization and sends the results to the Network Assessment: the devices it finds, the services they expose and the vulnerabilities that affect them.… - [Agents & Probes](https://wiki.cyberguard.srl/cat/agents.md): Most of CyberGuard runs in the portal, but some information can only be collected from inside your network. For that, CyberGuard provides small programs that run on a machine of your organization… - [Active Directory Agent](https://wiki.cyberguard.srl/cat/agents/active-directory.md): The Active Directory agent collects the data of the Active Directory assessment. It runs on a machine of your domain and sends the results to the portal. - [Microsoft 365 Agent](https://wiki.cyberguard.srl/cat/agents/microsoft-365.md): The Microsoft 365 agent completes the Microsoft 365 assessment with the data the portal cannot read directly: Exchange Online, Microsoft Defender, Purview, SharePoint, Teams and mailbox statistics. - [Run as a Service](https://wiki.cyberguard.srl/cat/agents/service.md): Installed as a Windows service, the Active Directory and Microsoft 365 agents become probes: they wait for the portal, run the assessments you start with Run Assessment or schedule, and send the… - [Users & Permissions](https://wiki.cyberguard.srl/cat/administration/users.md): Everyone in your organization signs in to CyberGuard with their Microsoft work account. Administrators decide who can access the portal and what each person can do, in Company Profile → Edit → Users. - [Scheduling](https://wiki.cyberguard.srl/cat/administration/scheduling.md): CyberGuard can run your assessments automatically, so that the Security Score always reflects the current state of your environment without anyone having to remember to start them. You configure… - [Email Notifications](https://wiki.cyberguard.srl/cat/administration/email-notifications.md): CyberGuard can send email notifications about what happens to your automatic assessments: a scheduled assessment that completed or failed, a probe that stopped responding, a weekly summary of the…