Sagan medium stable other

[BOX] Successful Login from Outside HOME_COUNTRY

[BOX] Successful Login from Outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[BOX] Successful Login from Outside HOME_COUNTRY"; program:box-api_data; json_map:"src_ip",".ip_address"; json_content:".event_type","LOGIN"; country_code:track by_src,isnot $HOME_COUNTRY; reference:url,https://developer.box.com/guides/events/enterprise-events/for-enterprise/; classtype:suspicious-activity; sid:5015225; rev:1; metadata:created_at 2025_01_14, updated_at 2025_01_14;)

Field Validations

Loading…

Comments (0)

Loading comments...