Elastic medium stable kql

First Seen SonicWall Remote Access Login by User and Source

Identifies a successful SonicWall VPN- or WAN-zone administrator or remote-user login from a source IP that was not previously observed with the same user on the same appliance during the prior 14 days. This may indicate stolen credentials, compromised administrator access, or unauthorized remote access.

View Source

Detection Logic

data_stream.dataset:"sonicwall_firewall.log" and
  event.action:"login-success" and
  event.code:("235" or "236" or "237" or "238" or "1080") and
  source.ip:* and user.name:* and observer.serial_number:*

False Positives

⚠ New administrators or VPN users, travel, mobile networks, ISP address rotation, managed service providers, and first observations after integration onboarding or retention loss can trigger this rule.

Field Validations

Loading…

Comments (0)

Loading comments...