Monitoring failed privilege escalations is a basic security hygiene check. Delinea's reporting is decent, but you need to actively alert on this, not just review logs.
Here's a quick setup using their webhooks and a generic HTTP alerting tool (like Splunk, PagerDuty, or even a custom script):
* In your Delinea PAM portal, navigate to Administration -> Notifications.
* Create a new notification for the event `Privileged account elevation failed`.
* Set the action to `Webhook`. Point it to your alerting system's ingestion endpoint.
Key config in the webhook payload mapping:
* Ensure `{EVENT_DETAILS}` and `{ACCOUNT_NAME}` are included.
* Filter noise: set a threshold, like 5 failures in 60 seconds from the same source, at the alerting tool level.
Without this, you're relying on someone manually checking reports. This creates a critical lag.