Break Glass Account Sign-in Detected
This rule detects sign-in attempts by 'Break Glass' accounts. Break Glass accounts are emergency access accounts typically used in situations where normal administrative access methods are unavailable. Monitoring their usage is critical due to the high privileges usually associated with these accounts. The rule joins sign-in logs with a watchlist of identities to specifically identify activity related to these designated accounts.
Microsoft Sentinel (KQL)
