Sagan informational stable other

[ONELOGIN] USER_LOGGED_INTO_ONELOGIN From Outside HOME_COUNTRY

[ONELOGIN] USER_LOGGED_INTO_ONELOGIN From Outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[ONELOGIN] USER_LOGGED_INTO_ONELOGIN From Outside HOME_COUNTRY"; json_content: ".event_type_id", "5"; json_pcre:".risk_score","/\x22([678][0-9]
| 100)\x22/"; country_code:track by_src,isnot $HOME_COUNTRY; json_map: "src_ip", ".ipaddr"; parse_src_ip: 1; classtype: system-event; program: onelogin; sid:5014684; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...