↳ GitHub sourceAnalytics ruleMedium

Red Sift - Login from previously unseen IP address

Description

'Detects a successful login from an IP address that has not been seen in the previous 14 days for that user, which may indicate compromised credentials or unauthorized access.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 1h
Query period: 14d
Trigger: gt 0

Declared MITRE coverage

InitialAccess T1078

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

RedSiftPush

Data types

RedSiftAuth_CL

KQL query

Original query, unchanged.

let lookback = 14d;
let recentWindow = 1h;
let historicalLogins = RedSiftAuth_CL
| extend
    ActivityName = tostring(column_ifexists("ActivityName", "")),
    UserEmail = tostring(column_ifexists("UserEmail", "")),
    SrcIp = tostring(column_ifexists("SrcIp", ""))
| where TimeGenerated between (ago(lookback) .. ago(recentWindow))
| where ActivityName has "Logon"
| where isnotempty(UserEmail) and isnotempty(SrcIp)
| summarize by UserEmail, SrcIp;
RedSiftAuth_CL
| extend
    ActivityName = tostring(column_ifexists("ActivityName", "")),
    UserEmail = tostring(column_ifexists("UserEmail", "")),
    SrcIp = tostring(column_ifexists("SrcIp", "")),
    HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
    ServiceName = tostring(column_ifexists("ServiceName", "")),
    Severity = tostring(column_ifexists("Severity", ""))
| where TimeGenerated >= ago(recentWindow)
| where ActivityName has "Logon"
| where isnotempty(UserEmail) and isnotempty(SrcIp)
| join kind=leftanti (historicalLogins) on UserEmail, SrcIp
| project
    TimeGenerated,
    UserEmail,
    SrcIp,
    HttpUserAgent,
    ServiceName,
    ActivityName,
    Severity

Declared entities

AccountIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Red Sift/Analytic Rules/RedSiftLoginFromNewIP.yaml ↗
Commit: 9800e51 ↗
Source identifier: c3d4e5f6-a7b8-9012-cdef-123456789012

Additional source files 2

Solutions/Red Sift/Analytic Rules/RedSiftLoginFromNewIP.yamlsource ↗Solutions/Red Sift/Data/Solution_RedSift.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.