Symantec Privileged Access Management

  • Private Community
 View Only
Back to discussions
Expand all | Collapse all

PAM - how to track source IP address that triggers PAM-CMN-xxxx: Possible injection attack session message log

  • 1.  PAM - how to track source IP address that triggers PAM-CMN-xxxx: Possible injection attack session message log

    Posted May 22, 2025 04:43 PM

    HI Broadcom Community

                   We have inquiry about the PAM-CMN-xxxx Possible injection attack message log appear on the PAM session manager log. is there a way for us to track and identify the IP address of the attacker that triggered the "PAM-CMN-xxxx Possible injection attack" alarm? can we trace this using any of the PAM function or audit reports? Please advise Thank you



  • 2.  RE: PAM - how to track source IP address that triggers PAM-CMN-xxxx: Possible injection attack session message log

    Broadcom Employee
    Posted May 28, 2025 03:54 PM

    Hello, When you double-click on the message, or when you export session log messages, you will see a bunch of IP columns such as the "NAT/Proxy Address". If no proxy is involved, this should be the source IP. If the private IP is set, it could be that. There may be more information in the system logs, which would have to be examined by PAM Support.


    Original Message