Elastic low stable eql
Spike in Logon Events
A machine learning job found an unusually large spike in successful authentication events. This can be due to password spraying, user enumeration or brute force activity.
Detection Logic
False Positives
- ⚠ Build servers and CI systems can sometimes trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert.
Field Validations
Loading…
Comments (0)
Loading comments...