Sagan informational stable other

[ONELOGIN] USER_LOGGED_INTO_ONELOGIN after Brute Force

[ONELOGIN] USER_LOGGED_INTO_ONELOGIN after Brute Force

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[ONELOGIN] USER_LOGGED_INTO_ONELOGIN after Brute Force"; json_content: ".event_type_id", "5"; json_pcre:".risk_score","/\x22([678][0-9]
| 100)\x22/"; country_code:track by_src,isnot $HOME_COUNTRY; json_map: "src_ip", ".ipaddr"; parse_src_ip: 1; xbits:isset,brute_force,track ip_src; classtype: system-event; program: onelogin; sid:5014685; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...