Panther medium experimental python

OneLogin Unauthorized Access

A OneLogin user was denied access to an app more times than the configured threshold.

View Source

Detection Logic

def rule(event):
    # filter events; event type 90 is an unauthorized application access event id
    return str(event.get("event_type_id")) == "90"


def title(event):
    return (
        f"User [{event.get('user_name', '<UNKNOWN_USER>')}] has exceeded the unauthorized "
        f"application access attempt threshold"
    )

Field Validations

Loading…

Comments (0)

Loading comments...