Crown jewels.

Name what you cannot lose. See who and what can reach it.

The finance database, the domain controllers, the backup server, the certificate authority. MagenX works backwards from each one and builds the answer from the directory, the firewall and your endpoint consoles together, because no single source can answer it alone.

SQL-FIN-01 finance database · tier 0 adjacent FIREWALL 3 subnets one is the guest VLAN ACTIVE DIRECTORY 14 rights holders 5 of them look dormant WHERE THEY SIT 3 seated in reach 4 not placed anywhere HOST FIREWALL drops 1 of 3 per the endpoint console
  1. Firewall · FortiGate

    3 subnets can open a session to it on 1433, one of them the guest VLAN, and the card names the rule that lets each one through.

  2. Active Directory

    14 accounts and groups hold rights over it: LAPS readers, the computer's owner and inherited permissions. 5 of them look dormant.

  3. Where they sit

    3 of the 14 sit on machines in a subnet the firewall lets through, so their rights can be used today. 4 have no known machine at all, which makes them the easiest to miss.

  4. Host firewall

    Its own firewall, as the endpoint console reports it, drops 1433 from 1 of the 3 subnets.

The answer is one sentence per jewel: whether anyone who holds rights over it sits somewhere the firewall lets them reach it from. For SQL-FIN-01 three do, and the card names the rule that lets them through, which is the sort of thing a directory audit alone cannot tell you.