admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

filter

Browse Source
This commit is contained in:
bpatel
2020-12-16 18:26:07 -08:00
parent fdb698cdb3
commit ee9d4131bc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/high_number_of_login_failures_from_a_single_source.yml
+1 -1
View File
@@ -5,7 +5,7 @@ date: '2020-12-16'
description: This search detects more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment.
type: ESCU
author: Bhavin Patel, Splunk
search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory | stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app | search accounts_locked >= 5| `high_number_of_login_failures_from_a_single_source_file`'
search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory | stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app | search accounts_locked >= 5| `high_number_of_login_failures_from_a_single_source_filter`'
known_false_positives: unknown
tags:
analytics_story: