topic Re: First SSO access from an uncommon ASN by user in Cortex XDR Discussions

First SSO access from an uncommon ASN by user

DragomirGaliaIT — Tue, 31 Jan 2023 06:36:10 GMT

Hello everyone,

Recently we started getting these types of incidents in our SOC team for Cortex XDR.

It shows that the user connected with SSO using this ASN.

However, it says that the ASN 263461 is suspicious but we can't verify it with lookup tool.

Any idea how to investigate this properly?

Alert info:

The user successfully authenticated via SSO. The user accessed SSO via ASN 263461. This ASN is used by 0 users in the organization. The user has not used this ASN in the past 30 days.

Let me know if there's any other info that you need in order to help me out.

Best regards.

Re: First SSO access from an uncommon ASN by user

aleksandar.astardzhiev — Tue, 31 Jan 2023 08:01:40 GMT

Hi @DragomirGaliaIT ,

The alert only says the ASN is uncommon for your organization. This is different from saying ASN is suspicious.

This alert is raised by XDR Analytics, which in nutshell look for anomalies in your log data. Anomaly by itself doesn't mean something is malicious/suspicious.

In this specific case XDR notify you that user have performed SSO with IP from ASN that was not used by any other of your users for the last 30 days. It is up to your to verify if that user is currently traveling and it is expected for him to connect from such ASN (based on his geo-location).

My first suggestion is to pay more attention to the alert - it is common misconception that uncommon/rare = suspicious or malicious.

We receive similar alerts, but for GP login. So what we usually do is to check and confirm if this users is indeed traveling at the moment and if it is expected for him to connect to such ASN. If we cannot confirm this by other information we contact the user or some manager to confirm

Re: First SSO access from an uncommon ASN by user

DragomirGaliaIT — Tue, 31 Jan 2023 08:49:59 GMT

Thanks for the explanation. It was indeed regular connection, user has connected using NordVPN for this. Nothing suspicious at all.