Related Cygna Products
Cygna Forest Recovery recovers domain controllers, domains, and forests when the directory itself is damaged or compromised. Other Cygna Labs products cover the everyday changes that lead up to that point: who changed what, whether the change was risky, and how to undo it. They are separate products, installed and licensed separately. Cygna Forest Recovery does not connect to them, and you don't need any of them to use Cygna Forest Recovery.
Cygna Auditor
Cygna Auditor records changes across Active Directory, Entra ID, Microsoft 365, file systems, and other sources, with search, reports, and alerts that can be sent to a SIEM or Syslog server.
- Risk Radar—Detects unusual activity in the audit data, such as sign-ins from an unusual location or a burst of failed sign-ins, and runs a daily assessment of Active Directory security posture: privileged groups, Kerberos settings, delegation, identity hygiene, and trusts. Risk Radar reports what it finds; it doesn't change anything.
- Recovery for Active Directory module—Rolls back individual objects and attributes to earlier values, and recovers deleted objects. It works on objects, not on whole domain controllers, domains, or forests.
- Recovery for Entra ID module—Recovers and rolls back Entra ID users and groups.
Each recovery module is licensed separately from Cygna Auditor's auditing.
Choosing the right product
| Situation | Use |
|---|---|
| A user, group, or attribute was changed or deleted by mistake | The Recovery for Active Directory or Recovery for Entra ID module of Cygna Auditor. A directory restore is not needed to undo a few object changes. |
| You need to know who made a change, or to be alerted to risky activity | Cygna Auditor and Risk Radar. |
| A domain controller is corrupted or will not start | Cygna Forest Recovery. See Choosing a Recovery Approach. |
| A domain or the whole forest is compromised or lost | Cygna Forest Recovery. After the recovery, Cygna Auditor's change history and Risk Radar's posture assessment can help you review the recovered directory. |
For more about these products, see the Cygna Auditor documentation or contact Cygna Labs.
