auth_rare_source_ip_for_a_user.json

{
  "description": "Security: Authentication - Looks for a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts.",
  "groups": ["security", "authentication"],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "detector_description": "Detects rare source IP for a user.",
        "function": "rare",
        "by_field_name": "source.ip",
        "partition_field_name": "user.name",
        "detector_index": 0
      }
    ],
    "influencers": ["source.ip", "user.name", "host.name"]
  },
  "allow_lazy_open": true,
  "analysis_limits": {
    "model_memory_limit": "128mb"
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "custom_settings": {
    "created_by": "ml-module-security-auth",
    "security_app_display_name": "Unusual Source IP for a User to Logon from",
    "managed": true,
    "job_revision": 4
  }
}