IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This query creates a list of IP addresses with the number of failed login attempts to Entra ID above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any of these IPs within the same timeframe.

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID ba144bf8-75b8-406f-9420-ed74397f9479
Severity Medium
Kind Scheduled
Tactics InitialAccess, CredentialAccess
Techniques T1078, T1110
Required Connectors AzureActiveDirectory, AzureActiveDirectory, PaloAltoNetworks
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
CommonSecurityLog DeviceEventClassID == "globalprotect"
DeviceVendor == "Palo Alto Networks"
?

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
CefAma Common Event Format
CloudNSSAuditLogs_ccp Zscaler Internet Access
CloudNSSCASBActivityLogs_ccp Zscaler Internet Access
CloudNSSCASBCRMLogs_ccp Zscaler Internet Access
CloudNSSCASBCloudStorageLogs_ccp Zscaler Internet Access
CloudNSSCASBCollabLogs_ccp Zscaler Internet Access
CloudNSSCASBEmailLogs_ccp Zscaler Internet Access
CloudNSSCASBFileSharingLogs_ccp Zscaler Internet Access
CloudNSSCASBITSMLogs_ccp Zscaler Internet Access
CloudNSSCASBRepoLogs_ccp Zscaler Internet Access
CloudNSSDNSLogs_ccp Zscaler Internet Access
CloudNSSEmailDLPLogs_ccp Zscaler Internet Access
CloudNSSEndpointDLPLogs_ccp Zscaler Internet Access
CloudNSSFWLogs_ccp Zscaler Internet Access
CloudNSSTunnelLogs_ccp Zscaler Internet Access
CloudNSSWebLogs_ccp Zscaler Internet Access
VirtualMetricDirectorProxy VirtualMetric DataStream
VirtualMetricMSSentinelConnector VirtualMetric DataStream
VirtualMetricMSSentinelDataLakeConnector VirtualMetric DataStream

Solutions: Common Event Format, VirtualMetric DataStream, Zscaler Internet Access


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules