remote login analysis using IP addresses - unreliable?

[Chris_B]

@Marie_Chudolij  YouTube video 2-27-24 - Chronicle SOAR to the Rescue: Orchestrate SIEM Reference List Updates for Improved Threat Detection

I suggest IP addresses and info inferred from IP address can be unreliable for remote login analysis as:

- the geo location is not 100% reliable per se
- logins via VPNs with changing IPs
- logins via cloud resources (why is Joe from Chicago coming in from Council Bluffs, IA every few minutes?)

In future sessions I'm interested in more behavior based analysis to look for bad remote logins.

I enjoyed the YouTube video - thx for your work

[dnehoda]

Hi Chris - 

I think a couple things pop in my head here.  I dont disagree about the IP addresses not painting the whole picture.   There's options that we can include with that specific IP,  including GEO Info plus username, plus the time frames of these logins, etc.  to understand what normal behavior is for Joe.   IP alone certainly isn't going to give us a ton a lot to go after.   

We have released the new UEBA capabilities within Chronicle in Enterprise and Enterprise plus editions.   Plus there's some new yara-l language to help with these kinds of issues.  

https://cloud.google.com/chronicle/docs/detection/metrics-functions#function_parameters

Check it out! Have a good night!