Detections

Abnormal Behaviors, Monitoring

By monitoring your environment in real time, historical data, and audit logs, abnormal behavior detection rules are used to detect any suspicious activity that could lead to an organization breach. As for monitoring rules, they focus on real-time visibility, discovering new entities and facts about your organization's secrets.

Abnormal Behavior

Secret has been viewed by a human account

Vault Dump

Previously inactive token is now active again

Previously disabled token has been reactivated

Production secret is fetched by a Script

Production secret is fetched by IDE

Production token is used by IDE client

Secret was fetched by a new workload

Secret / Token activity from restricted region

Idle identity fetched a secret

NHI Token Used by Multiple Devices

Too many entities are fetching the same secret

Monitoring

Overused secrets

Failed attempt to many secrets

Failed attempt to single secret