DET-H15: Key released to an unregistered host¶
A key broker released a key to a host whose hardware identity is not enrolled in the fleet's identity register, or is quarantined: the release reached hardware that never passed identity review.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Relying-party release decision / fleet identity register |
| Related check | KMS-01: KMS key policy enforces RecipientAttestation |
Fires when¶
relying-party key release to an asset NOT IN the identity register
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.