azure:pim
Entra Privileged Identity Management logs
- Host type
- Azure (platform and Entra ID)
- Tier, as a whole
- Recommended
- Techniques
- 0
- Rules listed
- 7
- Events
- 0
Why this tier
OMB M-26-14 A4 (Privilege changes; our analysis)
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Privilege changes | Supports an activity | our analysis: privileged role activation |
Techniques
No ATT&CK analytic names this source.
Rules
Sigma 7
- Invalid PIM License by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Roles Activated Too Frequently by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Roles Activation Doesn't Require MFA by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Roles Are Not Being Used by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Roles Assigned Outside PIM by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Stale Accounts In A Privileged Role by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Too Many Global Admins by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Events
No event-level rows: this source is tiered as a whole.