Panther medium experimental python

1Password Login From CrowdStrike Unmanaged Device

Detects 1Password Logins from IP addresses not found in CrowdStrike''s AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    return (
        "1Password Login for "
        f"[{event.deep_get('target_user', 'email', default = '<email_not_found>')}]"
        " from unmanaged IP Address."
    )

Field Validations

Loading…

Comments (0)

Loading comments...