Skip to main content

Violations

The Violations page provides visibility into potential vulerabilities that Corsha has detected either from network traffic or the machine identity's own attributes.

The violations page in console

Traffic Violations​

Reused Machine Identity Violation​

This violation occurs when a machine identity, typically associated with a unique device or server, sends traffic from multiple IP addresses over a period of time. This behavior may suggest that the machine identity is reused across different systems or locations, which is a violation of best practices. It could also suggest that malicious actor may have gained unauthorized access to this machine identity, using it to gain access to protected services.

Banned Country Traffic Violation​

This violation occurs when traffic is detected from a country that is flagged as banned by security policies. Many organizations implement geo-blocking or geo-fencing to protect against high-risk regions known for cyber threats. Traffic originating from one of these banned countries may indicate attempts to bypass security controls, potentially signaling malicious activities.

AuthN From Banned Country Violation​

This violation occurs when a request for an access token originates from a country or region that is banned based on security policies. Access from certain countries may be prohibited due to heightened risks of fraud, cyberattacks, or regulatory compliance issues. When access tokens are issued from a banned location, it can signal potential misuse of secrets, geolocation-based policy violations, or efforts to bypass regional security controls.

note

This violation pertains to machines from Azure Entra ID.

Machine Identity Violations​

Expired Secret Violation​

This violation occurs when a secret has expired, leading to a loss in trust and potential disruptions of secure communication between systems. Expired secrets can result in authentication failures blocking access to critical services.

note

This violation pertains to machines from Azure Entra ID.

Excessive Validity Period Violation​

This violation occurs when a secret is issued with an unreasonably long validity period, which may increase the risk of unauthorized access. Excessive validity periods reduce the effectiveness of security measures, as they provide more time for attackers to potentially gain access, exploit, or misuse these secrets.

note

This violation pertains to machines from Azure Entra ID.

Secret Age​

This violation occurs when a secret is too old, meaning it has not been rotated or updated in a reasonable period. Over time, secrets and credentials may become vulnerable to unauthorized access, either through exposure or brute force attacks. Stale credentials also pose a higher risk of being leaked, misused, or exploited by attackers who have gained access to outdated systems or repositories. Regular rotation of secrets and credentials is a best practice for maintaining a secure environment and reducing the risk of compromise.

note

This violation pertains to machines from Azure Entra ID and Amazon Cognito.

Shared IP violation​

This violation occurs when a single IP address is associated with multiple machines on a network, which can indicate unauthorized activity, misconfiguration, or the presence of man-in-the-middle attacks. Typically, each IP address maps to a single, unique MAC address via ARP. When multiple machines appear to use the same IP address, it can disrupt network stability and suggest malicious behavior. Attackers might exploit this condition to spoof devices, hijack sessions, or intercept network traffic.

note

This violation pertains to machines from asset discovery sources and Corsha's own machine discovery.

Violation Information​

Each violation record typically includes:

  • Severity: How serious a violation is (Low, Medium, High, Critical, Unknown)
  • Discovered At: When the violation was originally found
  • Last Found: When the violation was most recently triggered
  • Source: Machine associated with violation (if there is one)
  • Description: Short explanation for what the violation is
  • Details: Opens a modal for each violation taillor to type to show more information

Viewing Violations​

Filtering Violations​

Common filtering options:

  • Severity: Filter by the severity of the violation
  • Violation Type: Filter by the type of violation
  • Time Range: Filter by when the violation was discovered

Sorting and Searching​

Sort violations by:

  • Severity
  • Type
  • Discovered At
  • Last Found

Search violations by:

  • Machine name (if violation has an associated machine)
  • Description