T1110.004 | LoFP

T1110.004

Title	Tags
a source ip failing to authenticate with multiple users in a short period of time is not common legitimate behavior.	t1110 T1110.003 T1110.004 t1586 t1586.003 o365 tenant okta tenant splunk
a source ip failing to authenticate with multiple users is not a common for legitimate behavior.	t1110 T1110.003 T1110.004 t1586 t1586.003 azure active directory splunk
an ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.	t1110 T1110.003 T1110.004 aws account splunk
fidelity of this is high as it is okta threatinsight. filter and modify as needed.	t1078 t1078.001 T1110.003 T1110.004 infrastructure splunk
no known false positives for this detection. please review this alert	t1110 T1110.003 T1110.004 t1586 t1586.003 google cloud platform tenant splunk
no known false postives for this detection. please review this alert.	t1110 T1110.003 T1110.004 t1586 t1586.003 google cloud platform tenant splunk
this detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of vpns or cloud services that rotate ip addresses. filter as needed.	t1110 T1110.003 T1110.004 t1586 t1586.003 azure tenant o365 tenant splunk
vulnerability scanners or system administration tools may also trigger this detection. filter as needed.	t1003.002 t1021.002 t1087 t1110 T1110.004 t1135 endpoint splunk