LoFP / investigate where if active time period for a role is set too short.

Techniques

• t1078

Sample rules

Roles Activated Too Frequently

• source: sigma
• technicques:
  • t1078

Description

Identifies when the same privilege role has multiple activations by the same user.

Detection logic

condition: selection
selection:
  riskEventType: sequentialActivationRenewalsAlertIncident