Admin rights end when the grant does, even if the timer doesn't.
Event: the person stops SAP Privileges' timer while they hold admin rights.
- Admin granted, reason: “Install the printer driver”
- SAP Privileges' timer stopped, and Altiward raises an alert
- The grant expires
- Altiward removes the rights and records how the session ended
In the console, and in your SIEM.
The console's Overview, and the Altiward overview dashboard for Splunk that comes with the server, built from the same events.
Revoke an unauthorised admin account
The account support2 appeared on MBP-2291 while jdoe held approved admin. Here's how you take its rights away.
The same button revokes an approved session early. Revoking removes the admin rights; the account itself stays for you to deal with. Accounts that should always be admin, like your macOS LAPS account, are listed in Altiward's profile and left alone.
{
"class_name": "Detection Finding",
"activity_name": "Create",
"severity": "High",
"finding_info": {
"title": "Admin account created",
"desc": "New admin account support2 appeared on MBP-2291 while jdoe held admin rights",
"types": ["Persistence"],
"attacks": [{
"sub_technique": {
"uid": "T1136.001",
"name": "Local Account"
}
}]
},
"device": { "hw_info": { "serial_number": "MBP-2291" } },
"user": { "name": "jdoe" },
"metadata": { "product": { "name": "Altiward" } }
}The same events reach Microsoft Sentinel and any syslog receiver, so findings sit next to the rest of your security data.
Altiward is in early access.
Early access is for Mac teams who already deploy SAP Privileges through an MDM such as Jamf or Intune.