Ivanti connect secure multiple blocked web requests detected

This rule is part of a beta feature. To learn more, contact Support.
ivanti-connect-secure

Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

Set up the ivanti-connect-secure integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects a high frequency of blocked web requests, which may indicate potential security incidents, such as unauthorized access attempts, reconnaissance activities, or misconfigured systems generating anomalous traffic.

Strategy

This rule monitors blocked web requests across users and raises an alert if the count exceeds the threshold, which may signify suspicious activity or operational anomalies that require investigation.

Triage and Response

  1. Identify the user {{@usr.name}} associated with the blocked requests.
  2. Check for patterns like repeated login failures, unusual request volumes, or connections from suspicious IPs.
  3. Investigate recent policy changes or misconfigurations that might explain the activity.
  4. If malicious behavior is detected, block offending IPs, restrict access, and review account and access controls.