PAM360 Resource Deleted Shortly After Privileged Access

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects deletion of a managed resource from the vault following privileged access to it. Removing the resource destroys the record of which credentials existed and who held them, which is both destructive and a way of covering the preceding access. Treat the deletion as evidence tampering rather than as routine housekeeping unless a decommissioning record exists. Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=audit where sourcename='PAM360' and action='RESOURCE_DELETED' | groupby user, targetuser, srcip, message