Thycotic Secret Server Heartbeat or Sync Anomaly

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects heartbeat and synchronisation events in Secret Server. Heartbeat verifies a stored credential still works on the target. Repeated failures mean the credential has changed outside the vault — which happens when an attacker rotates it to lock the organisation out of its own privileged account. Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=secretserver-secret where sourcename='SECRET-SERVER' and action in ('HEARTBEAT', 'SYNCHRONIZED') | duration 1h | groupby user, file, filetype