We currently have the user case  - High Number of Login Failures from a single source turned on We would like to exclude some IP ranges from the search that we failover our staff to. Our Search terms at the moment is - index=appext_o365 `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory | stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app | search accounts_locked >= 10| `high_number_of_login_failures_from_a_single_source_filter` I added | search src_ip!="###.##.##.17" |  which does remove that one IP, from the search but obviously I dont want to manually put in 1 to 128. Any assistance would be very much appreciated ... View more

Hi All, We have turned on the Use Case - ESCU 0365 Authentication Failures Alert We need this turned on in order to assess risky logins, however due to the nature of the company (being a University) we have alot of old unused Alumni accounts that we cannot get rid of. The issue we are running into is that the risk scores of some of these accounts are consistently rising causing a consistent volume of Highs.  We have found that the accounts are trying to login via the user agent BAV2ROPC which is the Azure User Agent for Legacy Authentication (IMAP, POP3 etc) We have tried adding these users to a conditional access policy in Azure to prevent these Authentication attempts but that has not worked. The question I am asking is, is there any possible way in the Use Case search to specifically filter our BAV2ROPC so we do not constantly get these alerts as they are causing alot of noise within our search and it is making it difficult to find actual attempts to access users accounts. This is our Correlation Search for this use case index=appext_o365 `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter` ... View more

Hi, I need some help setting up a dashboard that will allow us to closely monitor login activity of certain users and the IP address' they use to ensure we don't have any exploiters trying to access our systems.   Another thing I would like to do, if possible, is to create a dashboard where we can input a username, and then it will show us the login data for that user over a certain period of time. Regards, Aidan Smith ... View more