Sagan informational stable other

[ONELOGIN] ONELOGIN_DESKTOP_LOGIN_SUCCESS High Risk Score

[ONELOGIN] ONELOGIN_DESKTOP_LOGIN_SUCCESS High Risk Score

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[ONELOGIN] ONELOGIN_DESKTOP_LOGIN_SUCCESS High Risk Score"; json_content: ".event_type_id", "904"; parse_src_ip: 2; pcre:"/risk_score\x22:\x22(?:7[6-9]
| [8-9]\d
| \d{3,})\x22/"; classtype: system-event; program: onelogin; sid:5010906; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...