Suspicious Impossible Travel Logon - Salesforce
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Detects Salesforce logins from geographically distant locations within an unrealistically short time, indicating possible credential compromise or account misuse.
Severity
Critical
Rule Requirement
Criteria
e1:
actionname = "Salesforce Successful Login Events"
| groupby USERNAME
| groupby HOSTNAME having dcount(SOURCE_COUNTRY) > 1
| last 1 IPADDRESS
select e1.HOSTNAME, e1.USERNAME, e1.HOSTNAME.IPADDRESS, e1.HOSTNAME.SOURCE_COUNTRY
Detection
Execution Mode
scheduled
Log Sources
Miscellaneous
