Analytics
Informational
✕
A user accessed multiple time-consuming websites
A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent
ATT&CK tactics: Reconnaissance (TA0043)
ATT&CK techniques: Search Open Websites/Domains (T1593)
Attacker's goals:
A user may utilize work time for personal reasons.
Investigative actions:
Investigate the domains accessed and how popular they are in the organization. Verify that the user is not part of a department that visits these websites as part of their daily operations.
- Test period:
- 12 Hours
- Deduplication:
- 1 Day