admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating azure

Browse Source
This commit is contained in:
patel-bhavin
2022-09-26 16:50:02 -05:00
parent 86c4816f98
commit db9068b4fb
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI
| stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
| eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress
| eval upperBound=(ip_avg+ip_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1
| `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
log category.