Centrify Linux Role Added Granting Server Access
Detects a role being added in Centrify for Linux. Roles determine which servers an identity can reach and what it may do there, so adding one is a durable grant of access to Unix infrastructure that frequently sits outside the scope of Windows centric monitoring. Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED' | groupby user, targetuser, role, group, domain
Sigma
