Sagan informational stable other

[CyberArk] Monitor Session Start Failed

[CyberArk] Monitor Session Start Failed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[CyberArk] Monitor Session Start Failed"; program:cyberark; content:"Cyber-Ark"; content:"Action=Monitor Session Start Failed"; distance:0; classtype:system-event; reference:url,docs.cyberark.com/Product-Doc/OnlineHelp/PAS/11.4/en/Content/EVD/Action-Codes.htm; sid:5010877; rev:1; metadata:created_at 2023_01_11, updated_at 2023_07_28;)

Field Validations

Loading…

Comments (0)

Loading comments...