Unknown Login Entries in CloudSOC History for User fHc7JH4yj79efrQ839rnlX80HJqw2JaqUI8k71bj

book

Article ID: 223823

calendar_today

Updated On:

Products

CASB Security Premium

Issue/Introduction

CloudSOC history reports user fHc7JH4yj79efrQ839rnlX80HJqw2JaqUI8k71bj logged in.
 
Is user fHc7JH4yj79efrQ839rnlX80HJqw2JaqUI8k71bj a security concern?

Resolution

User fHc7JH4yj79efrQ839rnlX80HJqw2JaqUI8k71bj is a CloudSOC system account that makes reporting calls.

An enhancement has been requested to give a better description of the event such as "System Report".  It is not a user that can be impersonated and it does not produce a security risk.

Additional Information

The impersonate user verbage records the CloudSOC sysadmin that configured the report or compiled the data.

 

is_authenticated: 'True'; host: '144.49.247.65'; timezone: 'GMT+0:00'; login_type: 'API_LOGIN'; useragent: 'Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1'; user_email: 'fHc7JH4yj79efrQ839rnlX80HJqw2JaqUI8k71bj'; user_to_impersonate: '[email protected]'

Attachments