DocumentationExperience Cloud KCS

Investigate privileged-action alerts in Adobe Experience Manager Assets access logs

Last update: October 27, 2026

This article explains how to interpret access log entries in Adobe Experience Manager (AEM) that involve service accounts used for asset sharing and security validation agents, helping distinguish legitimate activity from suspicious events.

Description description

Environment

Adobe Experience Manager (AEM), all deployment models and versions.

Issue/Symptoms

Security monitoring tools may detect access log entries indicating that a service account has performed a privileged action. These entries often include:

  • User: asset sharing service account
  • Agent: security validation agent
  • Path: asset-navigation endpoints (such as /libs/cq/i18n/foo.assetnavigation.json)
  • Referer: asset sharing or validation-related URLs
  • HTTP Method: GET
  • HTTP Code: 200

Cause

These detections are typically triggered by legitimate, authorized automated security validation activity or asset sharing functionality within AEM. The service account and agent are used for asset sharing and validation processes, and the observed request patterns match expected behavior for these operations.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Review the access log entry and verify that it has the following characteristics:

    • The user is a service account associated with asset sharing.
    • The user agent is identified as a security validation agent.
    • The request path matches asset sharing or asset navigation endpoints.
    • The request uses the GET method and returns an HTTP 200 response.

  2. Correlate the request with expected asset sharing or automated validation activity in your environment.

  3. For detection tuning purposes, classify requests that match this pattern as legitimate automated activity.

  4. Do not suppress alerts solely based on the user account, user agent, referrer, or client IP address because these values can be spoofed.

  5. Continue to investigate and generate alerts for the following activity:

    • Requests targeting unexpected endpoints.
    • Requests that use state-changing HTTP methods, such as POST, PUT, or DELETE.
    • Authorization failures.
    • Abnormal request volumes.
    • Activity performed by non-service accounts.

  6. If you identify materially different or suspicious activity, collect the timestamp and complete request details for further analysis.

  7. Verify that the activity matches expected asset sharing or automated validation patterns and does not indicate unauthorized access.

recommendation-more-help
experience-cloud-kcs-help-kbarticles