Teleport

Telemetry Evidence

These values show how indexed rules identify Teleport telemetry.

A long-lived cert was created source medium: An unusually long-lived Teleport certificate was createdT1098
A SAML Connector was created or modified source high: A SAML connector was created or modifiedT1585
A Teleport Lock was created source informational: A Teleport Lock was created
A Teleport Role was modified or created source medium: A Teleport Role was modified or createdT1098.001
A user authenticated with SAML, but from an unknown company domain source medium: A user authenticated with SAML, but from an unknown company domainT1098
A User from the company domain(s) Logged in without SAML source medium: A User from the company domain(s) Logged in without SAMLT1685
Teleport Create User Accounts source high: A user has been manually created, modified, or deletedT1136
Teleport Network Scan Initiated source medium: A user has invoked a network scan that could potentially indicate enumeration of the network.T1046
Teleport Scheduled Jobs source medium: A user has manually edited the Linux crontabT1053
Teleport SSH Auth Errors source medium: A high volume of SSH errors could indicate a brute-force attackT1110

Show 3 more

Teleport Suspicious Commands Executed source medium: A user has invoked a suspicious command that could lead to a host compromiseT1059
User Logged in as root source medium: A User logged in as rootT1059
User Logged in wihout MFA source high: A local User logged in without MFAT1078