PAM360 Privileged Session Started Without Credential Checkout

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects a privileged session beginning with no preceding credential retrieval by the same account. The expected sequence is checkout then session. A session without one suggests the credential was obtained outside the vault — cached, shared, or stolen — which defeats the control the vault exists to provide. Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam stream for the same user within a preceding window. Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=audit where sourcename='PAM360' and action='SESSION_STARTED' | groupby user, targetuser, srcip, devicetype