Detecting privileged access activity: A new Kibana integration
Blog post from Elastic
Elastic has introduced a new Privileged Access Detection package as a technical preview in Kibana versions 8.18 and 9.0, designed to detect suspicious privileged access activities across Windows, Linux, and Okta environments. Utilizing machine learning, the package establishes baseline behaviors to identify anomalies in privileged account activities, such as unusual access patterns or multiple concurrent sessions from the same account, which could signal unauthorized use. The package's workflow involves data preparation, featurization, and machine learning, with features transformed from raw event logs being analyzed to detect anomalous behavior. It includes 21 anomaly detection jobs and dedicated dashboards to help security teams investigate and address detected anomalies efficiently. This integration aims to enhance organizational security by identifying deviations from typical usage patterns in hybrid IT environments, allowing for more proactive threat detection and response.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.