Keycloak impossible user travel detected

This rule is part of a beta feature. To learn more, contact Support.
keycloak

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

Set up the keycloak integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Identify instances where users are trying to login from two distant geographical locations within an improbable time frame, potentially indicating credential theft or account compromise.

Strategy

This rule analyzes login events to identify cases where a user appears to perform activities from two different countries or cities within a time frame that would make physical travel between those locations impossible.

Triage and response

  1. Determine if userId {{@usr.id}} connected from {{@impossible_travel.triggering_locations.first_location.city}}, {{@impossible_travel.triggering_locations.first_location.country}} and {{@impossible_travel.triggering_locations.second_location.city}}, {{@impossible_travel.triggering_locations.second_location.country}} in a short period of time.
  2. Check for any failed login attempts or other unusual activities related to the user.
  3. Contact the affected user to verify whether they initiated the login events.
  4. If the user did not perform the logins, restrict their access until their credentials are reset.