Forum Discussion
Graeme735
May 21, 2021Copper Contributor
Sign-ins from IPs that attempt sign-ins to disabled accounts
I've had a few alerts called "Sign-ins from IPs that attempt sign-ins to disabled accounts", the Description says "Identifies IPs with failed attempts to sign in to one or more disabled accounts sign...
nabilsayeed
May 21, 2021Copper Contributor
You could search the logs to see what other accounts have signed in from that IP:
union SigninLogs
| where IPAddress contains "IPHERE"
union SigninLogs
| where IPAddress contains "IPHERE"
Graeme735
May 21, 2021Copper Contributor
Thanks Nabilsayeed, that's the puzzle, the only login attempts from that IP for that time period are from the disabled account, I can't find a successful logins from that IP address.