admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml

Browse Source
This commit is contained in:
Gowthamaraj rajendran
2023-08-17 13:46:12 -07:00
parent 5939c509f7
commit 9edfbeeb89
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
+1 -1
View File
@@ -20,7 +20,7 @@ description: The following analytic identifies multiple failed multi-factor auth
data_source: []
search: ' `azuread` category=SignInLogs properties.status.errorCode=500121
| rename properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts
values(userPrincipalName) as userPrincipalName by userPrincipalName, status.additionalDetails, appDisplayName,
values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName,
userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).