Jumpcloud policy created

jumpcloud

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1484-domain-or-tenant-policy-modification

Set up the jumpcloud integration.

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a JumpCloud policy is created.

Strategy

This rule lets you monitor the following JumpCloud event to detect when a policy is created:

  • @evt.name:policy_create

Triage and response

  1. Contact the JumpCloud administrator {{@usr.email}} to confirm if the policy creation was intended.
  2. If the change was not authorized, verify there are no other signals from the administrator:{{@usr.email}}.