Ivanti connect secure multiple blocked web requests detected
Set up the ivanti-connect-secure integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detects a high frequency of blocked web requests, which may indicate potential security incidents, such as unauthorized access attempts, reconnaissance activities, or misconfigured systems generating anomalous traffic.
Strategy
This rule monitors blocked web requests across users and raises an alert if the count exceeds the threshold, which may signify suspicious activity or operational anomalies that require investigation.
Triage and Response
- Identify the user
{{@usr.name}} associated with the blocked requests. - Check for patterns like repeated login failures, unusual request volumes, or connections from suspicious IPs.
- Investigate recent policy changes or misconfigurations that might explain the activity.
- If malicious behavior is detected, block offending IPs, restrict access, and review account and access controls.
