Unusual account creations from an IP
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect excessive account creations from an IP.
This may be caused by a malicious actor trying to create bots on your platform or abuse discounts to new users.
Required business logic events
Datadog auto-instruments many event types. Review your instrumented business logic events. This detection requires the following instrumented event:
Strategy
Count the number of user signups generated coming from a single IP.
Require the signup to be flagged using a user event.
The rule determines the standard rate for IPs to create new users.
If an IP is seen significantly exceeding the normal rate, a Medium signal will be generated.
Note
This rule is using a new feature of ASM that isn’t yet available in custom detection rules.
This will prevent you from cloning this rule and having it work the same way as the Datadog version.
We’re working toward solving this limitation.
Triage and response
- Investigate the IP activity and validate that it is legitimate.
- Extract the list of created account to lock/delete them.
- Consider blocking the IP if the account creations are malicious.
