Sigma medium experimental sigma

Suspicious Login Activity Classified By Google

Detects Google Workspace login activity that's classified as suspicious by Google.

View Source

Detection Logic

{
  "selection": {
    "protoPayload.Servicename": "login.googleapis.com",
    "protoPayload.metadata.event.eventName": [
      "suspicious_login_less_secure_app",
      "suspicious_login",
      "suspicious_programmatic_login"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate logins

Field Validations

Loading…

Comments (0)

Loading comments...