Jumpcloud admin login without MFA
Set up the jumpcloud integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect when a JumpCloud administrator authenticates without multi-factor authentication (MFA) enabled. This is not indicative of malicious activity, however as a best practice, administrator accounts should have MFA enabled.
Strategy
This rule monitors JumpCloud audit logs to detect when an admin user successfully authenticates to JumpCloud and the log indicates that @mfa is false.
Triage and response
- Reach out to the {{@usr.name}} to determine if the login was legitimate.
- If the login was legitimate, request that the user enables MFA.
- If the login wasn’t legitimate, rotate the credentials, enable MFA and triage an actions uncovered from step 1.
- Review all user accounts to ensure MFA is enabled.
