Centrify Linux Privileged Command Executed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a privileged command run through Centrify on Linux. Because elevation is brokered, the platform records what was actually executed under elevated rights — a cleaner record of privileged activity than shell history, which the user can edit. Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='USER_COMMAND_EXECUTED' | groupby user, targetuser, role, domain