Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Detects command line parameters used by Hydra password guessing hack tool

Detects suspicious user agent strings user by hack tools in proxy logs

Detect failed authentications from countries you do not operate out of.

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Detect successful authentications from countries you do not operate out of.

Alert on when legecy authentication has been used on an account

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Detects common NTLM brute force device names

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.