Successful Access from a Previously Only Failing IP

Detects successful logins with an IP address that was used to probe other accounts in the organization.

Recommended Actions

Contact the end user to verify the origin of the actions.