This alert will trigger once more then 10 different users will fail VPN authentication from a single IP address. Malicious actors will try and authenticate to the company's VPN from compromised computers in order to try and gain access to sensitive assets. This type of activity can indicate a brute force attack trying to obtain user credentials and company access. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. Enforce password changes to company devices for the relevant users. If needed, Block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once a single user will fail VPN authentication from more then 10 IP addresses in a time range of 10 minute. Failed authentication from multiple IP addresses indicates that a malicious actor got a hold of the users credential and trying to authenticate to the company's VPN solution in order to gain access to sensitive resources. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Confirm with the user if he was the cause for those authentication. Enforce password changes to company devices for the relevant user. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once if there are more then 5 failed authentication attempts from the same user. Malicious actors will try to authenticate to the company's VPN from compromised computers in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once a user that was not seen in the last 7 days will fail an authentication attempt. Malicious actors will try to authenticate to the company's VPN in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once an IP that was not seen in the last 7 days will fail an authentication attempt. Malicious actors will try to authenticate to the company's VPN in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This rule detects if there are no logs in the last 12 hours from AWS VPN. Note- This alert should be fine-tuned with the relevant app & subsystem below. Impact Disabling logging is a tactic that adversaries might employ as part of various MITRE ATT&CK techniques to avoid detection, cover their tracks, or impede incident response investigations. Mitigation Address logging concerns to ensure comprehensive monitoring within the Coralogix SIEM system. MITRE Tactic: TA0005 MITRE Technique:T1562

This alert will trigger once if there are more then 5 failed authentication attempts from the same IP address. Malicious actors will try to authenticate to the company's VPN from compromised computers in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078