↳ GitHub sourceAnalytics ruleLow
Uniqkey - Sign-in from unfamiliar IP address
Description
Identifies successful Uniqkey sign-ins (browser extension, mobile, web or desktop) originating from an IP address that has not been observed for that user during the trailing 14 days. A new source address can indicate session hijacking or use of stolen master credentials, particularly when combined with an unusual client system. Uniqkey audits successful authentications only, so pair this rule with identity-provider telemetry if failed sign-in coverage is required.
- Rule type
- Scheduled
- Version
- 1.0.0
- Query frequency
- 1h
- Query period
- 14d
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let lookback = 14d;
let frequency = 1h;
let knownPairs =
UniqkeyEvents_CL
| where TimeGenerated between (ago(lookback) .. ago(frequency))
| where Category == "authentication" and isnotempty(SrcIpAddr) and isnotempty(ActorEmail)
| summarize by ActorEmail, SrcIpAddr;
UniqkeyEvents_CL
| where TimeGenerated > ago(frequency)
| where Category == "authentication" and isnotempty(SrcIpAddr) and isnotempty(ActorEmail)
| join kind=leftanti knownPairs on ActorEmail, SrcIpAddr
| summarize arg_max(TimeGenerated, Action, ActionId, ActorType, ClientSystem) by ActorEmail, SrcIpAddr
| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, ClientSystem, SrcIpAddrDeclared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
6909c70c-fb52-47a3-9eb9-3b8109b0b32a
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC