Semperis-Operation-Log
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 20002 | DSP failed logon | Operational | N | Y |
| 20012 | DSP RBAC change | Operational | N | Y |
Event ID 20002: DSP failed logon
#Description
Semperis Directory Services Protector (DSP) logs a failed logon to the DSP system itself (its web administration console). Written to a custom Windows event channel on the DSP management server and ingested into Microsoft Sentinel's SecurityEvent table via a custom Data Collection Rule.
Fields #
| Name | Description |
|---|---|
TrusteeName | Account attempting the failed logon, as DOMAIN\user, parsed from the event details. |
HostIP | Source IP address of the failed logon attempt. |
NTDomain | Domain portion of TrusteeName. |
Name | User portion of TrusteeName. |
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Category | eq | Semperis-Operation-Log | 1 rule | kusto |
Community Notes #
Third-party product event (Semperis Directory Services Protector). Consumed by the Semperis-authored Sentinel analytic rule 'Semperis DSP Failed Logons' (query filters SecurityEvent for EventSourceName 'Semperis-Operation-Log' and EventID 20002). Grounding is vendor documentation, not Microsoft; no first-party sample captured.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto # view in coverage
T1078, T1110
References #
Event ID 20012: DSP RBAC change
#Description
Semperis DSP logs a role-based-access-control change inside the DSP application: an identity is added to or removed from a DSP persona (DSP's internal permission role). This is a DSP-application RBAC change, not a Windows or Active Directory RBAC change.
Fields #
| Name | Description |
|---|---|
LoginUser | Account whose DSP persona membership changed. |
NTDomain | Domain of LoginUser. |
HostName | Host associated with the change. |
DnsDomain | DNS domain of the host. |
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Category | eq | Semperis-Operation-Log | 1 rule | kusto |
Community Notes #
Third-party product event (Semperis Directory Services Protector). Consumed by the Semperis-authored Sentinel analytic rule 'Semperis DSP RBAC Changes' (EventSourceName 'Semperis-Operation-Log', EventID 20012; mapped to ATT&CK T1548 and T1098). Grounding is vendor documentation.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto # view in coverage
T1098, T1548