Failed Authentications From Non-Operational Countries
Detects failed authentication attempts originating from geographic locations (countries) that are not part of the organization's approved operational regions. This rule helps identify potential unauthorized access attempts or credential stuffing attacks from unexpected sources.
Sigma
