PAM360 Privileged Password Retrieved Outside Business Hours

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects retrieval of a privileged credential from the PAM360 vault outside normal working hours. Credential checkout is the moment privileged access actually begins, and an out-of-hours retrieval with no corresponding change ticket is the earliest reliable indicator of vault misuse. Tune the window to the customer's working pattern before deployment; a global estate will need per-region hours rather than a single range. Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED' | groupby user, targetuser, srcip, role