H3c Successive different Location Logons
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
H3C Successive Logon from different locations
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "h3cvpnlogon" | timewindow 5m | having DCOUNT(IP_ADDRESS_COUNTRY) > 2 select Action1.timewindow.MESSAGE,Action1.timewindow.HOSTNAME,Action1.timewindow.USERNAME,Action1.timewindow.REMOTE_IP,Action1.timewindow.C_IP_COUNTRY,Action1.timewindow.IP_ADDRESS_COUNTRY
Detection
Execution Mode
realtime
Log Sources
Network
