Elastic high stable kql

CyberArk Privileged Access Security Recommended Monitor

Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code.

View Source

Detection Logic

data_stream.dataset:cyberarkpas.audit and
  event.code:(4 or 22 or 24 or 31 or 38 or 57 or 60 or 130 or 295 or 300 or 302 or
              308 or 319 or 344 or 346 or 359 or 361 or 378 or 380 or 411) and
  not event.type:error

False Positives

  • ⚠ To tune this rule, add exceptions to exclude any event.code which should not trigger this rule.

Field Validations

Loading…

Comments (0)

Loading comments...