Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Correlates the archival, deletion or detachment of a Uniqkey employee account with data exports performed by that same employee during the preceding 14 days. An employee who exports credentials shortly before losing access is a classic insider-risk scenario, and organization credentials touched by the export should be considered for rotation. The action filter matches the offboarding action identifiers from the Uniqkey audit-log catalog, with a name-based fallback for future action variants.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Uniqkey |
| ID | cee6bbae-e1ee-4b65-9782-6afce5c330e6 |
| Severity | High |
| Kind | Scheduled |
| Tactics | CredentialAccess, Exfiltration |
| Techniques | T1555 |
| Required Connectors | UniqkeyEventsConnector |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
UniqkeyEvents_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊