Views:

After identifying a potentially compromised user account, you can sign the user out of all active application and browser sessions.

This task is supported by the following services:
  • Active Directory (on-premises)
  • Google Cloud Identity
  • Microsoft Entra ID
  • Okta
  • OpenLDAP
This task requires a complete account identifier that includes both the user name and the identity provider domain. The action is not available for values that contain only a user name without a domain because TrendAI Vision One™ cannot reliably identify the target account.

Procedure

  1. After identifying the potentially compromised user account, select Force Sign Out from the context or response menu.
  2. Specify a description for the task.
  3. Click Create.
  4. Monitor the task status.
    1. Go to Workflow and Automation → Response Management .
    2. Locate the task using the Search field or by selecting Force Sign Out from the Action list.
    3. View the task status.
      • In progress (in_progress=GUID-A55897DB-3DEA-4F5C-B7F9-70B3D7FB9EDE=1=en-us=Low.jpg): TrendAI Vision One™ sent the command and is waiting for a response.
      • Successful (successful=GUID-1E31AD86-DE2E-48B5-85F7-7C78A3E8BB11=1=en-us=Low.jpg): The command was successfully executed.
      • Partially successful (partially_successful_icon=GUID-20230103030733.jpg): The task was unsuccessful on one or more IAM service.
      • Unsuccessful (error=5cc21722-7ceb-480c-b9c2-a47d420cf1cc.jpg): The task was unsuccessful on all connected IAM services.