Detection rules › Panther
OneLogin Active Login Activity
Multiple user accounts logged in from the same ip address.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1550 Use Alternate Authentication Material |
Rule body yaml
AnalysisType: rule
Filename: onelogin_active_login_activity.py
RuleID: "OneLogin.ActiveLoginActivity"
DisplayName: "OneLogin Active Login Activity"
Enabled: true
LogTypes:
- OneLogin.Events
Tags:
- OneLogin
- Lateral Movement:Use Alternate Authentication Material
Severity: Medium
Reports:
MITRE ATT&CK:
- TA0008:T1550
Threshold: 3
DedupPeriodMinutes: 720
Description: Multiple user accounts logged in from the same ip address.
Reference: https://support.onelogin.com/kb/4271392/user-policies
Runbook: Investigate whether multiple user's logging in from the same ip address is expected. Determine if this ip address should be added to the SHARED_IP_SPACE array.
SummaryAttributes:
- account_id
- user_name
- user_id
Tests:
- Name: Login Event - Counts Toward Threshold
ExpectedResult: true
Log:
{
"event_type_id": "5",
"actor_user_id": 123456,
"actor_user_name": "Bob Cat",
"user_id": 123456,
"user_name": "Bob Cat",
"ipaddr": "203.0.113.55",
}
- Name: Non-Login Event Type - No Match
ExpectedResult: false
Log:
{
"event_type_id": "6",
"actor_user_id": 123456,
"actor_user_name": "Bob Cat",
"user_id": 123456,
"user_name": "Bob Cat",
}
- Name: Shared IP Login Event - No Match
ExpectedResult: false
Log:
{
"event_type_id": "5",
"actor_user_id": 123456,
"actor_user_name": "Bob Cat",
"user_id": 123456,
"user_name": "Bob Cat",
"ipaddr": "192.168.1.1",
}
Detection logic
Condition
not (event_type_id ne "5" or ipaddr is_null or user_id is_null)
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
event_type_id | ne | 5 |
ipaddr | is_null | |
user_id | is_null |
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
ipaddr |