Sagan informational stable other

[ONELOGIN] USER_FAILED_ONELOGIN_LOGIN From Outside HOME_COUNTRY

[ONELOGIN] USER_FAILED_ONELOGIN_LOGIN From Outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[ONELOGIN] USER_FAILED_ONELOGIN_LOGIN From Outside HOME_COUNTRY"; json_content: ".event_type_id", "6"; country_code:track by_src,isnot $HOME_COUNTRY; json_map: "src_ip", ".ipaddr"; json_map: "username", ".user_name"; xbits: set,brute_force,track ip_src, expire 21600; after: track by_src&by_username, count 10, seconds 300; classtype:system-event; program: onelogin; sid:5014682; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...