sigmalowHunting

OneLogin User Account Locked

Detects when an user account is locked or suspended.

Detection Query

selection1:
  event_type_id: 532
selection2:
  event_type_id: 553
selection3:
  event_type_id: 551
condition: 1 of selection*

Author

Austin Songer @austinsonger

Created

2021-10-12

Data Sources

oneloginonelogin.events

Platforms

onelogin

References

https://developers.onelogin.com/api-docs/1/events/event-resource/

Tags

attack.impact

Raw Content

title: OneLogin User Account Locked
id: a717c561-d117-437e-b2d9-0118a7035d01
status: test
description: Detects when an user account is locked or suspended.
references:
    - https://developers.onelogin.com/api-docs/1/events/event-resource/
author: Austin Songer @austinsonger
date: 2021-10-12
modified: 2022-12-25
tags:
    - attack.impact
logsource:
    product: onelogin
    service: onelogin.events
detection:
    selection1: # Locked via API
        event_type_id: 532
    selection2: # Locked via API
        event_type_id: 553
    selection3: # Suspended via API
        event_type_id: 551
    condition: 1 of selection*
falsepositives:
    - System may lock or suspend user accounts.
level: low