SonicWall SMA — Anomalous Session from Unfamiliar Geo/ASN Immediately Post-CVE Disclosure Window

Ankit Mehta@Secvyn

•updated Aug 10, 2026•1•0•5

This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).