You can track users logging in from multiple OSes by aggregating events per user over 30 days. Use principal.platform for OS and $username for identity. Group events by user, then check if more than one unique OS appears. In pseudocode:
for each user in last 30 days:
get unique principal.platform values
if count > 1:
alert "User logged in from multiple OS"
Make sure to normalize OS names and handle missing principal.platform values to avoid false negatives.
Thank you.
I am currently applying and using YARA-L with the following rule:
events:
$login.metadata.event_type = "USER_LOGIN"
$login.target.user.userid = $user
$login.principal.platform = $os
$login.target.user.user_display_name = $user_display_name
match:
$user over 14d
outcome:
$os_count = count_distinct($os)
$os_list = array_distinct($os)
condition:
$login and $os_count > 1
At the moment, I am stuck on how to extend the detection window from 14 days to 30 days.
From my understanding, Google SecOps may have a limitation where the match window can only be defined up to 14 days.
Is this limitation correct, or am I misunderstanding the capability?
If the 14-day window is indeed the maximum, are there any alternative approaches or recommended methods to detect this behavior over a longer period (for example, 30 days)?
Do “metrics” going to help ?
Thank you in advance for your guidance.
