Techniques
Sample rules
OneLogin User Account Locked
- source: sigma
- technicques:
Description
Detects when an user account is locked or suspended.
Detection logic
condition: 1 of selection*
selection1:
event_type_id: 532
selection2:
event_type_id: 553
selection3:
event_type_id: 551