UBA : Anomalous Account Created From New Location

기본적으로 사용 가능

False

senseVaule 기본값

5

설명

새 위치에서 비정상 계정 작성 활동을 발견합니다.

지원 룰

필수 구성

다음 룰을 사용으로 설정하십시오. "UBA : User Geography Change"

로그 소스 유형

AhnLab Policy Center APC(이벤트 ID: Administrator Account Add:Succeeded, ADD_ADMIN_ACCOUNT_SUCCESS)

Application Security DbProtect(이벤트 ID: Database user created, Login created - standard, Login added - Windows, Database role - created)

Aruba Mobility Controller(이벤트 ID: authmgr_user_add)

Bit9 Security Platform (이벤트 ID: User_group_created, User_group_modified, User_group_deleted, Console_user_created, Console_user_modified, Console_user_deleted)

Box(이벤트 ID: NEW_USER)

Brocade FabricOS(이벤트 ID: SEC-1180,SEC-3025, SEC-1182)

CA ACF2 (EventID: ACF2-L)

Check Point(이벤트 ID: User Added, device_added)

Cilasoft QJRN/400(이벤트 ID: C20010, C20011)

Cisco Adaptive Security Appliance(ASA)(이벤트 ID: %PIX|ASA-5-502101, %ASA-5-502101)

Cisco Firewall Services Module(FWSM)(이벤트 ID: 502101, 504001)

Cisco IOS(이벤트 ID: %APF-6-USER_NAME_CREATED)

Cisco Identity Services Engine(이벤트 ID: 86006)

Cisco NAC Appliance(이벤트 ID: CCA-1500)

Cisco PIX Firewall(이벤트 ID: %PIX-0-502101, %PIX-1-502101, %PIX-2-502101, %PIX-3-502101, %PIX-4-502101, %PIX-5-502101, %PIX-6-502101, %PIX-7-502101)

Cisco PIX Firewall(이벤트 ID: 502101)

Cisco Wireless LAN Controllers(이벤트 ID: %APF-6-USER_NAME_CREATED, 1.3.6.1.4.1.9.9.515.0.2)

Cisco Wireless Services Module(WiSM)(이벤트 ID: %AAA-6-GUEST_ACCOUNT_CREATE, %APF-6-USER_NAME_CREATED)

CloudPassage Halo(이벤트 ID: Halo user added, Halo user re-added, Local account created(linux에만 해당))

CorreLog Agent for IBM zOS(이벤트 ID: RACF ADDUSER: No Violations)

Cyber-Ark Vault(이벤트 ID: 180, 2)

EMC VMWare(이벤트 ID: AccountCreatedEvent)

Extreme Dragon Network IPS(이벤트 ID: HOST:WIN:ACCOUNT-CREATED)

Extreme Matrix K/N/S Series Switch(이벤트 ID: created with, User Created Event)

Extreme NAC(이벤트 ID: Added registered user, Add Registered User)

Flow Classification Engine(이벤트 ID: 3031, 3041)

Forcepoint Sidewinder(이벤트 ID: passport addition)

Fortinet FortiGate Security Gateway(이벤트 ID: add, auth-logon)

Foundry Fastiron(이벤트 ID: SNMP_USER_ADDED)

HBGary Active Defense(이벤트 ID: CreateUser)

HP Network Automation(이벤트 ID: User Added)

IBM AIX Audit(이벤트 ID: USER_Create SUCCEEDED)

IBM AIX Server(이벤트 ID: USER_Create)

IBM DB2(이벤트 ID: ADD_USER SUCCESS)

IBM IMS(이벤트 ID: USER CREATED)

IBM Resource Access Control Facility(RACF)(이벤트 ID: 80 10.0, 80 10.2)

IBM Security Access Manager for Enterprise Single Sign-On(이벤트 ID: PRE_PROVISION_IMS_USER, AA_SCR_REGISTRATION, REGISTER_MAC_IDENTITY, REGISTER_IDENTITY)

IBM Security Directory Server(이벤트 ID: SDS Audit)

IBM Security Identity Governance(이벤트 ID: 49, 70004, 42)

IBM Security Identity Manager(이벤트 ID: Add Success, Add SUBMITTED, Add SUCCESS)

IBM SmartCloud Orchestrator(이벤트 ID: user)

IBM Tivoli Access Manager for e-business(이벤트 ID: 13402 - Succeeded, 13401 - Succeeded, 13402 Command Succeeded, 13401 Command Succeeded)

IBM i(이벤트 ID: GSL2401,MC@0300, GSL2402, M240100, CP_CRT)

Imperva SecureSphere(이벤트 ID: NEW_USERS_ACCOUNT, SOX_NEW_USERS, SOX - New users, New Users Account)

Itron Smart Meter(이벤트 ID: CEUI-AUDIT-27, CEUI.AUDIT.26)

Juniper Networks Network and Security Manager(이벤트 ID: adm23303, aut20167, adm30407, aut20168, adm20716, adm20717)

Linux OS(이벤트 ID: ADD_USER)

McAfee Application/Change Control(이벤트 ID: USER_ACCOUNT_CREATED)

McAfee ePolicy Orchestrator(이벤트 ID: 20792)

Microsoft ISA(이벤트 ID: user added)

Microsoft SQL Server(이벤트 ID: CR - SU, CR - US, CR - SL, CR - LX, CR - AR, CR - WU, 24127, 24121, 24075)

Microsoft SharePoint(이벤트 ID: 37)

Microsoft Windows Security Event Log(이벤트 ID: 624, 645, 1318, 4720, 4741)

NCC Group DDos Secure(이벤트 ID: 1003)

Netskope Active(이벤트 ID: Create Admin, Created new admin)

Novell eDirectory(이벤트 ID: CREATE_ACCOUNT)

OS Services Qidmap(이벤트 ID: User Account Added)

OSSEC(이벤트 ID: 5902, 18110)

Okta(이벤트 ID: app.user_management.push_new_user_success, app.generic.import.details.add_user, app.generic.import.new_user, app.user_management.provision_user, app.user_management.push_new_user, app.user_management.push_profile_success, core.user.config.user_creation.success, core.user_group_member.user_add, cvd.user_profile_bootstrapped, cvd.appuser_profile_bootstrapped)

OpenBSD OS(이벤트 ID: add user)

Oracle Enterprise Manager(이벤트 ID: User Create(successful), Computer Create(successful))

Oracle RDBMS Audit Record(이벤트 ID: 51:1, 51:0, CREATE USER-Standard:1, CREATE USER-Standard:0)

Oracle RDBMS OS Audit Record(이벤트 ID: 51)

Pirean Access: One(이벤트 ID: IsimUserRegistration;*;1)

Pulse Secure Pulse Connect Secure(이벤트 ID: ADM23303, ADM20265, AUT20167, ADM30407, AUT20168)

RSA Authentication Manager(이벤트 ID: Added user, unknown, REMOTE_PRINCIPAL_CREATE, CREATE_PRINCIPAL, CREATE_AM_PRINCIPAL)

SIM Audit(이벤트 ID: Configuration-UserAccount-AccountAdded)

STEALTHbits StealthINTERCEPT(이벤트 ID: Active DirectorycomputerObject AddedTrueFalse, Console ? user/group added, Console � user/group added, Active DirectoryuserObject AddedTrueFalse, Console - user/group added)

SafeNet DataSecure/KeySecure(이벤트 ID: Added user)

Salesforce Security Auditing(이벤트 ID: Created new Customer User, Created new user)

Skyhigh Networks Cloud Security Platform(이벤트 ID: 10016)

Solaris BSM(이벤트 ID: create user)

SonicWALL SonicOS(이벤트 ID: 558)

Symantec Encryption Management Server(이벤트 ID: ADMIN_IMPORTED_USER)

ThreatGRID Malware Threat Intelligence Platform(이벤트 ID: user-account-creation)

Trend Micro Deep Discovery Email Inspector(이벤트 ID: SYSTEM_EVENT_ACCOUNT_CREATED)

Trend Micro Deep Security(이벤트 ID: 650)

Universal DSM(이벤트 ID: Computer Account Added, User Account Added)

VMware vCloud Director(이벤트 ID: com/vmware/vcloud/event/user/create, com/vmware/vcloud/event/user/import)

Vormetric Data Security(이벤트 ID: DAO0089I)

iT-CUBE agileSI (EventID: U0, AU7)