Anvilogic high experimental spl
Auth0: User block released from anomaly detection [splunk-auth0]
Monitoring the release of a blocked user from anomaly detection being lifted. This could signal a legitimate user regaining access or a potential attacker bypassing security controls to regain entry. This rule will monitor events for ""ublkdu", OR "User block setup by anomaly detection has been released" with user blocks being released by anomaly detection, helping to identify potential unauthorized access or suspicious authentication activity.
Detection Logic
`get_authentication_data_auth0` "ublkdu"
OR "User block setup by anomaly detection has been released"
| where match(event_type = "(?i)ublkdu")
| table `add_fields_eoi` session_id, event_type, action, user, src_ip, http_user_agent
| bin span=1s
| stats values(*) as * by _time, userField Validations
Loading…
Comments (0)
Loading comments...