High Risk Login Detected

nomit vyas@xoxo

•updated Apr 30, 2026•1•0•90

This rule detects login events with a high-risk score (0.8 or greater) as determined by the 'castle' log source. It normalizes event and risk fields to ensure consistent detection.