UBA : Anomalous Account Created From New Location (Anomales Konto von neuem Standort erstellt)

Standardmäßig aktiviert

Falsch

senseValue-Standardwert

5

Beschreibung

Erkennt Aktivität zum Erstellen eines anomalen Kontos von einem neuen Standort aus.

Regeln für die Unterstützung

Erforderliche Konfiguration

Aktivieren Sie folgende Regel: "UBA : User Geography Change".

Protokollquellentypen

AhnLab Policy Center APC (Ereignis-ID: Administrator Account Add:Succeeded, ADD_ADMIN_ACCOUNT_SUCCESS)

Application Security DbProtect (Ereignis-ID: Database user created, Login created - standard, Login added - Windows, Database role - created)

Aruba Mobility Controller (Ereignis-ID: authmgr_user_add)

Bit9 Security Platform (Ereignis-ID: User_group_created, User_group_modified, User_group_deleted, Console_user_created, Console_user_modified, Console_user_deleted)

Box (Ereignis-ID: NEW_USER)

Brocade FabricOS (Ereignis-ID: SEC-1180,SEC-3025, SEC-1182)

CA ACF2 (EventID: ACF2-L)

Check Point (Ereignis-ID: User Added, device_added)

Cilasoft QJRN/400 (Ereignis-ID: C20010, C20011)

Cisco Adaptive Security Appliance (ASA) (Ereignis-ID: %PIX|ASA-5-502101, %ASA-5-502101)

Cisco Firewall Services Module (FWSM) (Ereignis-ID: 502101, 504001)

Cisco IOS (Ereignis-ID: %APF-6-USER_NAME_CREATED)

Cisco Identity Services Engine (Ereignis-ID: 86006)

Cisco NAC Appliance (Ereignis-ID: CCA-1500)

Cisco PIX Firewall (Ereignis-ID: %PIX-0-502101, %PIX-1-502101, %PIX-2-502101, %PIX-3-502101, %PIX-4-502101, %PIX-5-502101, %PIX-6-502101, %PIX-7-502101)

Cisco PIX Firewall (Ereignis-ID: 502101)

Cisco Wireless LAN Controllers (Ereignis-ID: %APF-6-USER_NAME_CREATED, 1.3.6.1.4.1.9.9.515.0.2)

Cisco Wireless Services Module (WiSM) (Ereignis-ID: %AAA-6-GUEST_ACCOUNT_CREATE, %APF-6-USER_NAME_CREATED)

CloudPassage Halo (Ereignis-ID: Halo user added, Halo user re-added, Local account created (linux only))

CorreLog Agent for IBM zOS (Ereignis-ID: RACF ADDUSER: No Violations)

Cyber-Ark Vault (Ereignis-ID: 180, 2)

EMC VMWare (Ereignis-ID: AccountCreatedEvent)

Extreme Dragon Network IPS (Ereignis-ID: HOST:WIN:ACCOUNT-CREATED)

Extreme Matrix K/N/S Series Switch (Ereignis-ID: created with, User Created Event)

Extreme NAC (Ereignis-ID: Added registered user, Add Registered User)

Flow Classification Engine (Ereignis-ID: 3031, 3041)

Forcepoint Sidewinder (Ereignis-ID: passport addition)

Fortinet FortiGate Security Gateway (Ereignis-ID: add, auth-logon)

Foundry Fastiron (Ereignis-ID: SNMP_USER_ADDED)

HBGary Active Defense (Ereignis-ID: CreateUser)

HP Network Automation (Ereignis-ID: User Added)

IBM AIX Audit (Ereignis-ID: USER_Create SUCCEEDED)

IBM AIX Server (Ereignis-ID: USER_Create)

IBM DB2 (Ereignis-ID: ADD_USER SUCCESS)

IBM IMS (Ereignis-ID: USER CREATED)

IBM Resource Access Control Facility (RACF) (Ereignis-ID: 80 10.0, 80 10.2)

IBM Security Access Manager for Enterprise Single Sign-On (Ereignis-ID: PRE_PROVISION_IMS_USER, AA_SCR_REGISTRATION, REGISTER_MAC_IDENTITY, REGISTER_IDENTITY)

IBM Security Directory Server (Ereignis-ID: SDS Audit)

IBM Security Identity Governance (Ereignis-ID: 49, 70004, 42)

IBM Security Identity Manager (Ereignis-ID: Add Success, Add SUBMITTED, Add SUCCESS)

IBM SmartCloud Orchestrator (Ereignis-ID: user)

IBM Tivoli Access Manager for e-business (Ereignis-ID: 13402 - Succeeded, 13401 - Succeeded, 13402 Command Succeeded, 13401 Command Succeeded)

IBM i (Ereignis-ID: GSL2401,MC@0300, GSL2402, M240100, CP_CRT)

Imperva SecureSphere (Ereignis-ID: NEW_USERS_ACCOUNT, SOX_NEW_USERS, SOX - New users, New Users Account)

Itron Smart Meter (Ereignis-ID: CEUI-AUDIT-27, CEUI.AUDIT.26)

Juniper Networks Network and Security Manager (Ereignis-ID: adm23303, aut20167, adm30407, aut20168, adm20716, adm20717)

Linux OS (Ereignis-ID: ADD_USER)

McAfee Application/Change Control (Ereignis-ID: USER_ACCOUNT_CREATED)

McAfee ePolicy Orchestrator (Ereignis-ID: 20792)

Microsoft ISA (Ereignis-ID: user added)

Microsoft SQL Server (Ereignis-ID: CR - SU, CR - US, CR - SL, CR - LX, CR - AR, CR - WU, 24127, 24121, 24075)

Microsoft SharePoint (Ereignis-ID: 37)

Microsoft Windows Security Event Log (Ereignis-ID: 624, 645, 1318, 4720, 4741)

NCC Group DDos Secure (Ereignis-ID: 1003)

Netskope Active (Ereignis-ID: Create Admin, Created new admin)

Novell eDirectory (Ereignis-ID: CREATE_ACCOUNT)

OS Services Qidmap (Ereignis-ID: User Account Added)

OSSEC (Ereignis-ID: 5902, 18110)

Okta (Ereignis-ID: app.user_management.push_new_user_success, app.generic.import.details.add_user, app.generic.import.new_user, app.user_management.provision_user, app.user_management.push_new_user, app.user_management.push_profile_success, core.user.config.user_creation.success, core.user_group_member.user_add, cvd.user_profile_bootstrapped, cvd.appuser_profile_bootstrapped)

OpenBSD OS (Ereignis-ID: add user)

Oracle Enterprise Manager (Ereignis-ID: User Create (successful), Computer Create (successful))

Oracle RDBMS Audit Record (Ereignis-ID: 51:1, 51:0, CREATE USER-Standard:1, CREATE USER-Standard:0)

Oracle RDBMS OS Audit Record (Ereignis-ID: 51)

Pirean Access: One (Ereignis-ID: IsimUserRegistration;*;1)

Pulse Secure Pulse Connect Secure (Ereignis-ID: ADM23303, ADM20265, AUT20167, ADM30407, AUT20168)

RSA Authentication Manager (Ereignis-ID: Added user, unknown, REMOTE_PRINCIPAL_CREATE, CREATE_PRINCIPAL, CREATE_AM_PRINCIPAL)

SIM Audit (Ereignis-ID: Configuration-UserAccount-AccountAdded)

STEALTHbits StealthINTERCEPT (Ereignis-ID: Active DirectorycomputerObject AddedTrueFalse, Console ? user/group added, Console � user/group added, Active DirectoryuserObject AddedTrueFalse, Console - user/group added)

SafeNet DataSecure/KeySecure (Ereignis-ID: Added user)

Salesforce Security Auditing (Ereignis-ID: Created new Customer User, Created new user)

Skyhigh Networks Cloud Security Platform (Ereignis-ID: 10016)

Solaris BSM (Ereignis-ID: create user)

SonicWALL SonicOS (Ereignis-ID: 558)

Symantec Encryption Management Server (Ereignis-ID: ADMIN_IMPORTED_USER)

ThreatGRID Malware Threat Intelligence Platform (Ereignis-ID: user-account-creation)

Trend Micro Deep Discovery Email Inspector (Ereignis-ID: SYSTEM_EVENT_ACCOUNT_CREATED)

Trend Micro Deep Security (Ereignis-ID: 650)

Universal DSM (Ereignis-ID: Computer Account Added, User Account Added)

VMware vCloud Director (Ereignis-ID: com/vmware/vcloud/event/user/create, com/vmware/vcloud/event/user/import)

Vormetric Data Security (Ereignis-ID: DAO0089I)

iT-CUBE agileSI (EventID: U0, AU7)