Microsoft Sentinel medium experimental kql

Palo Alto Prisma Cloud - Multiple failed logins for user

'Detects multiple failed logins for the same user account.'

View Source

Detection Logic

let threshold = 10;
PaloAltoPrismaCloud
| where ResourceType =~ 'Login'
| where EventResult =~ 'Failed'
| where EventMessage !has 'access key'
| summarize count() by UserName, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = UserName

Field Validations

Loading…

Comments (0)

Loading comments...