Centrify Windows Role Deleted

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects deletion of a role in Centrify for Windows. Removing a role can strip access from legitimate administrators during an incident, and it also erases the record of who was entitled to what — which complicates reconstructing the access position afterwards. Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='ROLE_DELETED' | groupby user, role, targetuser, domain