Failed logon attempts by valid accounts within 10 mins

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Identifies when failed logon attempts are 20 or higher during a 10 minute period (2 failed logons per minute minimum) from valid account.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	`0777f138-e5d8-4eab-bec1-e11ddfbc2be2`
Severity	Low
Kind	Scheduled
Tactics	CredentialAccess
Techniques	T1110
Required Connectors	SecurityEvents, WindowsSecurityEvents, WindowsForwardedEvents
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
`SecurityEvent`	✓	✓	?
`WindowsEvent`	✓	✓	?

The following connectors provide data for this content item:

Connector	Solution
ESI-Opt34DomainControllersSecurityEventLogs	Microsoft Exchange Security - Exchange On-Premises
SecurityEvents	Windows Security Events
WindowsForwardedEvents	Windows Forwarded Events
WindowsSecurityEvents	Windows Security Events

Solutions: Microsoft Exchange Security - Exchange On-Premises, Windows Forwarded Events, Windows Security Events

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊