Anvilogic high experimental other

GSUITE Successful login from Suspicious Country [snowflake-gsuite]

Looks for suspicious authentication in google workspace based on Country. Note: This use case will require allow listing for specific countries per organization in order to function correctly.

View Source

Detection Logic

select * from gsuite where event_time > dateadd(hour, -2, sysdate()) and event_name = 'google.login.LoginService.loginSuccess'

Field Validations

Loading…

Comments (0)

Loading comments...