Centrify Windows Account Unlocked

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects an account being unlocked through Centrify on Windows. Lockout is often the only visible consequence of a password-guessing attempt; an unlock immediately afterwards either restores a locked-out colleague or, if performed by the attacker who caused it, clears the obstacle so guessing can continue. Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED' | groupby user, targetuser, domain, role