admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-02-16 21:39:56 +00:00
committed by GitHub
parent 42c96cd751 e3328f1922
commit 780ee9caee
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/okta_user_logins_from_multiple_cities.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Rico Valdez, Splunk
type: batch
datamodel: []
description: This search detects logins from the same user from different states in
description: This search detects logins from the same user from different cities in
a 24 hour period.
search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
| stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)