Panther medium experimental python

A Teleport Role was modified or created

A Teleport Role was modified or created

View Source

Detection Logic

def rule(event):
    return event.get("event") == "role.created"


def title(event):
    return (
        f"User [{event.get('user', '<UNKNOWN_USER>')}] created Role "
        f"[{event.get('name', '<UNKNOWN_NAME>')}] "
        f"on [{event.get('cluster_name', '<UNKNOWN_CLUSTER>')}]"
    )

Field Validations

Loading…

Comments (0)

Loading comments...