Successful logon from IP and failure from a different IP

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


'Identifies when a user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account). UEBA added for context to gather all asoociated information assocaited with IP addressed initiating Faile Logon and affected user. Please note, Failed logons from known IP ranges can be benign depending on the conditional access policies. In case of noisy behavior, consid

Attribute Value
Type Analytic Rule
Solution Microsoft Entra ID
ID 02ef8d7e-fc3a-4d86-a457-650fa571d8d2
Severity Medium
Status Available
Kind Scheduled
Tactics CredentialAccess, InitialAccess
Techniques T1110, T1078
Required Connectors AzureActiveDirectory, AzureActiveDirectory, BehaviorAnalytics, BehaviorAnalytics
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
BehaviorAnalytics ?
IdentityInfo ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Microsoft Entra ID