Anvilogic high experimental spl

O365 Login Events [splunk-apply_al(avl_r7397)]

This use case looks for O365 Login Events. - Threat Actor Association: Lapsus$

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_o365` (UserLoginFailed 
OR PasswordLogonInitialAuthUsingPassword 
OR UserLoggedIn)
| eval action=if(isnotnull(LogonError), "failure", "success")
| table _time, host, user,account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id, bucket_name, bytes_in, bytes_out, file_path, requester_account, duration, login, failure_reason `group_events("user, src_ip",10min)`
| iplocation src_ip
| rename Region as region, Country as country, City as city

Field Validations

Loading…

Comments (0)

Loading comments...