This alert will trigger once more then 10 different users will fail VPN authentication from a single IP address. Malicious actors will try and authenticate to the company's VPN from compromised computers in order to try and gain access to sensitive assets. This type of activity can indicate a brute force attack trying to obtain user credentials and company access. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. Enforce password changes to company devices for the relevant users. If needed, Block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once a single user will fail VPN authentication from more then 10 IP addresses in a time range of 10 minute. Failed authentication from multiple IP addresses indicates that a malicious actor got a hold of the users credential and trying to authenticate to the company's VPN solution in order to gain access to sensitive resources. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Confirm with the user if he was the cause for those authentication. Enforce password changes to company devices for the relevant user. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once if there are more then 5 failed authentication attempts from the same user. Malicious actors will try to authenticate to the company's VPN from compromised computers in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once a user that was not seen in the last 7 days will fail an authentication attempt. Malicious actors will try to authenticate to the company's VPN in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078

This alert will trigger once an IP that was not seen in the last 7 days will fail an authentication attempt. Malicious actors will try to authenticate to the company's VPN in order to gain access to sensitive assets. Impact Malicious actors might gain access to sensitive assets and data. Mitigation Validate the origin of the IP address. If needed, enforce password changes to company devices for the relevant users. If needed, block the source IP in the organizations firewall. If needed, further investigate according to company policy. MITRE Tactic: TA0001 MITRE Technique: T1078