Ivanti connect secure multiple blocked web requests detected

This rule is part of a beta feature. To learn more, contact Support.

Set up the ivanti-connect-secure integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detects a high frequency of blocked web requests, which may indicate potential security incidents, such as unauthorized access attempts, reconnaissance activities, or misconfigured systems generating anomalous traffic.

Strategy

This rule monitors blocked web requests across users and raises an alert if the count exceeds the threshold, which may signify suspicious activity or operational anomalies that require investigation.

Triage and Response

  1. Identify the user {{@usr.name}} associated with the blocked requests.
  2. Check for patterns like repeated login failures, unusual request volumes, or connections from suspicious IPs.
  3. Investigate recent policy changes or misconfigurations that might explain the activity.
  4. If malicious behavior is detected, block offending IPs, restrict access, and review account and access controls.