Secret/Token Activity from Restricted Location

Vaulted Secret Retrieved from Device in Restricted Country

NHI Token Used from Device in Restricted Country

Description

SailPoint Entro observed secret / token usage activity by a device geolocated in a restricted country according to your company policy. This could indicate it might be used for malicious intentions or potential misuse.

Risk triggers

Audit log of token usage/secret retrieval originated from an IP geolocated in restricted regions.