Cisco Duo bypass code created by administrator
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when a Duo bypass code is created by an administrator.
Strategy
This rule monitors Cisco Duo activity logs for the creation of bypass codes by administrators. A bypass code is a temporary passcode created by an administrator for a specific user. These are generally used as “backup codes” to grant enrolled users access to their Duo-protected systems when they have problems with their mobile device, or when they’re temporarily unable to access their enrolled device.
Triage and Response
- Investigate the nature of the bypass code creation:
- Verify if the bypass code creation generated by user
{{@usr.email}} from device IP {{@access_device.ip.address}} was authorized and legitimate. - Identify the administrator responsible for the action.
- If unauthorized or suspicious activity is detected:
- Disable or review the administrator’s account.
- Reset any affected user accounts associated with the bypass codes.
- Initiate an investigation into potential security breaches.
