User login from different countries within 3 hours (Uses Authentication Normalization)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This query searches for successful user logins from different countries within 3 hours. To use this analytics rule, make sure you have deployed the ASIM normalization parsers

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID 09ec8fa2-b25f-4696-bfae-05a7b85d7b9e
Severity High
Kind Scheduled
Tactics InitialAccess
Techniques T1078
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules