Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0042 ✕ technique: T1586 ✕

Download CSV Show ATT&CK heatmap
  • VPN login Brute-Force attempt Informational Identity Analytics 2 variations

    A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    1 Hour
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
    ATT&CK techniques: Brute Force (T1110) Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
    Required data: Palo Alto Networks Global Protect Third-Party VPNs
    Attacker's goals: An attacker attempts to gain access to the account.
    Investigative actions: Verify successful connections by the user account, as these can indicate the attacker managed to guess the credentials. Analyze login patterns for abnormal times, locations, or IPs for suspicious activity. Look for VPN login attempts from countries where the organization does not typically operate. Cross-reference the IP addresses with threat intelligence sources. Follow further actions taken by the account.

    Variations

    Successful VPN Login Brute Force

    Low overridden

    A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack. overridden

    VPN login brute-force attempt with suspicious characteristics

    Low overridden

    A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack. overridden