admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2052 from schwedenmut/patch-1

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2022-03-01 09:30:52 -05:00
committed by GitHub
parent 32b5190096 63dcb7f00f
commit 3c1f3cf6cf
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_excessive_authentication_failures_alert.yml
+1 -1
View File
@@ -8,7 +8,7 @@ datamodel: []
description: This search detects when an excessive number of authentication failures
occur this search also includes attempts against MFA prompt codes
search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod
| stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod
values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user
| where count > 10
| `security_content_ctime(firstTime)`