Hello Team,
Today we faced an issue, where an alert for Impossible Travel Sucessfull was triggered where the country of thoses IPs are the same.
The below is the rule
rule impossible_travel_login_activity
{
meta:
subject = "impossible travel login activity"
description = "Detects when the same user account is logged into twice in a short period of time but from two different countries. This could indicate a user account credential compromise where an adversary obtains access to an account."
events:
$e.metadata.event_type = "USER_LOGIN"
$e.target.user.userid = $target_user
$e.principal.location.country_or_region != ""
$e.principal.location.country_or_region = $country
$e.security_result.action = "ALLOW"
match:
$target_user over 3h
outcome:
$risk_score = 80
$mitre_attack_tactic = "Initial Access
condition:
#country > 1
}
Could you please let me know what we are doing wrong here?
Thank you in advance.
With Regards,
Aravind S
