Centrify Linux Privilege Change on Server
Detects a privilege change recorded by Centrify on a Linux server. Centrify brokers privileged access to Unix estates, so it sees elevation decisions that native auditd may record only partially — and in many estates it is the only consistent record across heterogeneous Linux and AIX systems. Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='PRIVILEGE_CHANGED' | groupby user, targetuser, role, domain
Sigma
