Symantec VIP multiple numbers challenge failed events
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect multiple failed number challenge events in Symantec VIP, which could indicate unauthorized access attempts, user errors, or potential misconfigurations in authentication policies.
Strategy
Monitor repeated failures in the number challenge mechanism, which requires users to enter a unique two-digit number from the login screen into the VIP Access Push notification. Identify patterns of misuse, user confusion, or security threats and take prompt action to secure affected accounts.
Triage and response
- Identify the client IP
{{@network.client.ip}}, analyze the frequency, timing, and sources of the failed number challenge attempts. - Determine if the failures stem from user errors (such as incorrect input), device synchronization issues, or malicious activity like brute force attacks.
- For suspicious activity, block the source IPs, lock the account, and notify the user to reset their credentials.
- Assist users in resolving legitimate issues, such as troubleshooting devices or clarifying number challenge instructions.
- Document the incident, escalate confirmed threats, and refine detection rules or policies to enhance security.
