Insider threat detection
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Unusual or unauthorized user access after BitLocker policy changes, indicating potential insider threats.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "uem_bitlockerpolicy_status" Action2: actionname = "null" AND USERNAME = Action1.USERNAME Action3: actionname = "null" AND USERNAME = Action2.USERNAME AND USERNAME = Action1.USERNAME sequence:Action1 followedby Action2 within 10m followedby Action3 within 10m select Action1.MESSAGE,Action1.HOSTNAME,Action1.USERNAME,,
Detection
Execution Mode
realtime
Log Sources
ME Applications
