Update SuccessfulAccount-SigninAttemptsByIPviaDisabledAccounts

removing localized string in reference URL
This commit is contained in:
Shain 2020-07-30 10:52:05 -07:00 коммит произвёл GitHub
Родитель 075280d50f
Коммит bc13df96ac
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -1,7 +1,7 @@
name: Sign-ins from IPs that attempt sign-ins to disabled accounts
description: |
'Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account.
References: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
References: https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
50057 - User account is disabled. The account has been disabled by an administrator.' This analytic will additionally identify the successful signed in accounts as the mapped account entities for investigation in Sentinel.
severity: Medium
requiredDataConnectors: