Data Source: SonicWall Firewall Logs | Detection.FYI

First Seen SonicWall Remote Access Login by User and Source

Aug 24, 2026 · Domain: Network Domain: Identity Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Data Source: SonicWall Firewall Logs Rule Type: New Terms Resources: Investigation Guide ·
Share on:

Identifies a successful SonicWall VPN- or WAN-zone administrator or remote-user login from a source IP that was not previously observed with the same user on the same appliance during the prior 14 days. This may indicate stolen credentials, compromised administrator access, or unauthorized remote access.

Read More