Sagan informational stable other

[TENABLE] An administrator started a session where they impersonated another user

[TENABLE] An administrator started a session where they impersonated another user

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[TENABLE] An administrator started a session where they impersonated another user"; program:tenable_io_data; content:"
| 22
| action
| 22 3a 20 22
| session.impersonation.start
| 22
| "; classtype:system-event; reference:url,developer.tenable.com/reference/audit-log-events; sid:5010895; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...