↳ Source GitHubRègle analytiqueLow
Uniqkey - Sign-in from unfamiliar IP address
Description
Identifies successful Uniqkey sign-ins (browser extension, mobile, web or desktop) originating from an IP address that has not been observed for that user during the trailing 14 days. A new source address can indicate session hijacking or use of stolen master credentials, particularly when combined with an unusual client system. Uniqkey audits successful authentications only, so pair this rule with identity-provider telemetry if failed sign-in coverage is required.
- Type de règle
- Scheduled
- Version
- 1.0.0
- Fréquence
- 1h
- Période analysée
- 14d
- Déclenchement
- gt 0
Couverture MITRE déclarée
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Connecteurs
Types de données
Requête KQL
Requête originale, sans modification.
let lookback = 14d;
let frequency = 1h;
let knownPairs =
UniqkeyEvents_CL
| where TimeGenerated between (ago(lookback) .. ago(frequency))
| where Category == "authentication" and isnotempty(SrcIpAddr) and isnotempty(ActorEmail)
| summarize by ActorEmail, SrcIpAddr;
UniqkeyEvents_CL
| where TimeGenerated > ago(frequency)
| where Category == "authentication" and isnotempty(SrcIpAddr) and isnotempty(ActorEmail)
| join kind=leftanti knownPairs on ActorEmail, SrcIpAddr
| summarize arg_max(TimeGenerated, Action, ActionId, ActorType, ClientSystem) by ActorEmail, SrcIpAddr
| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, ClientSystem, SrcIpAddrEntités déclarées
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
9800e51↗- Identifiant source
6909c70c-fb52-47a3-9eb9-3b8109b0b32a
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC