Active Account Under Heavy Attack

Detects login attempts from an IP address associated with probing attempts against other accounts in the organization. A user will fail this check if Identity Intelligence detects more than 5 probing attempts.

Recommended Actions

Contact the end user to verify the origin of the actions. If you cannot verify the login, log the user out.

Default Check Settings

Minimum Number of Probing IP Addresses: 5

Evaluation Period (Days): 7

Compatibility

Microsoft Entra ID

Okta

Duo

Google Workspace

Last updated