First SSO access from an uncommon ASN by user

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

First SSO access from an uncommon ASN by user

L1 Bithead

Hello everyone,

Recently we started getting these types of incidents in our SOC team for Cortex XDR.

It shows that the user connected with SSO using this ASN.

However, it says that the ASN 263461 is suspicious but we can't verify it with lookup tool.

Any idea how to investigate this properly?

Alert info:

The user  successfully authenticated via SSO. The user accessed SSO via ASN 263461. This ASN is used by 0 users in the organization. The user has not used this ASN in the past 30 days.

Let me know if there's any other info that you need in order to help me out.

Best regards.

2 REPLIES 2

Hi @DragomirGaliaIT ,

The alert only says the ASN is uncommon for your organization. This is different from saying ASN is suspicious.

This alert is raised by XDR Analytics, which in nutshell look for anomalies in your log data. Anomaly by itself doesn't mean something is malicious/suspicious.

 

In this specific case XDR notify you that user have performed SSO  with IP from ASN that was not used by any other of your users for the last 30 days. It is up to your to verify if that user is currently traveling and it is expected for him to connect from such ASN (based on his geo-location).

 

My first suggestion is to pay more attention to the alert  - it is common misconception that uncommon/rare = suspicious or malicious.

We receive similar alerts, but for GP login. So what we usually do is to check and confirm if this users is indeed traveling at the moment and if it is expected for him to connect to such ASN. If we cannot confirm this by other information we contact the user or some manager to confirm

Thanks for the explanation. It was indeed regular connection, user has connected using NordVPN for this. Nothing suspicious at all.

  • 1789 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!