Salesforce OAuth login errors

Classification:

attack

Tactic:

Technique:

이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when a failed OAuth login occurs due to a potential nonce replay or when the access token generation limit is exceeded.

Salesforce tracks the outcomes of failed logins, which are available in @login_status or @status depending on your logging tier.

This rule monitors for the following status messages in login events:

To learn more about the variety of error messaging available for login events, refer to Salesforce documentation.

Examine the IP address, ASN, and geographic location associated with the login attempts for the associated user account.
Review the account and connected application for successful events.
If the IP address or user account demonstrate evidence of suspicious activities, initiate your incident response plan.