Anvilogic high experimental spl
Auth0: Email Notification Failure [splunk-auth0]
Threat actors may disrupt security notifications, password resets, or user communications by causing email delivery failures, either through misconfiguration or targeted attacks. This use case detects failed attempts to send email notifications, which could indicate email service issues, unauthorized changes to email settings, or attempts to suppress security alerts.
Detection Logic
`get_authentication_data_auth0` "fn"
OR "Failed to send email notification"
| where match(event_type, "(?i)^fn$")
| table _time, host, user, signature, City, Region, Country
| bin span=1s
| stats values(*) as * by _time, coi_userField Validations
Loading…
Comments (0)
Loading comments...