Correlation Rule
Medium
✕
CyberArk Failed Logins
This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.
- Module:
- Platform Analytics
- Data source:
- cyberark_identity_raw
- Category:
- Credential Access
- Content pack:
- CyberArk Identity
- Execution:
- SCHEDULED
- Search window:
- 10 minutes
XQL query:
datamodel dataset = cyberark_identity_raw |filter xdm.event.type="Cloud.Core.LoginFail" |comp count(xdm.event.type) as `Failed Logins` by xdm.target.user.username, xdm.source.ipv4 |filter `Failed Logins` >=4