Thycotic Secret Server Privileged Session Launched
Detects a privileged session launched from Secret Server. The launch is the moment privileged access begins, and it carries the identity, the target and the source address together — a cleaner attribution point than anything the target system will record about a shared administrative account. Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=secretserver-secret where sourcename='SECRET-SERVER' and action='LAUNCHED' | groupby user, file, filetype, srcip
Sigma
