CyberArk Failed Logins

This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.

CyberArk Identity MEDIUM CREDENTIAL_ACCESS

Details

ID	`dfa5c92b-9b98-46f3-a438-5eb64ad89420`
From Version	6.10.0
Execution Mode	SCHEDULED
Crontab	`/10 * * *`
Search Window	10 minutes
Dataset	alerts

XQL Query

datamodel dataset = cyberark_identity_raw 
|filter xdm.event.type="Cloud.Core.LoginFail"
|comp count(xdm.event.type) as `Failed Logins` by xdm.target.user.username, xdm.source.ipv4 
|filter  `Failed Logins` >=4

Source

CyberArkIdentity_Correlation_0.yml

Download History Raw

alert_category: CREDENTIAL_ACCESS
alert_description: This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.
alert_fields:
  actor_process_image_name:
  actor_process_image_path:
  actor_process_command_line:
  agent_device_domain:
  actor_process_image_sha256:
  agent_hostname:
  action_local_ip: xdm.source.ipv4
  action_remote_ip:
  action_remote_port:
  actor_effective_username: xdm.target.user.username
alert_name: CyberArk Failed Logins
crontab: '*/10 * * * *'
dataset: alerts
description: This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.
drilldown_query_timeframe: QUERY
execution_mode: SCHEDULED
global_rule_id: dfa5c92b-9b98-46f3-a438-5eb64ad89420
investigation_query_link:
mapping_strategy: CUSTOM
mitre_defs: {}
name: CyberArk Failed Logins
search_window: 10 minutes
severity: SEV_030_MEDIUM
suppression_duration:
suppression_enabled: false
suppression_fields:
user_defined_category:
user_defined_severity:
xql_query: "datamodel dataset = cyberark_identity_raw \r\n|filter xdm.event.type=\"Cloud.Core.LoginFail\"\r\n|comp count(xdm.event.type) as `Failed Logins` by xdm.target.user.username, xdm.source.ipv4 \r\n|filter  `Failed Logins` >=4 "
fromversion: 6.10.0