QuestionQ14Verified/Rules and subpatternsCopy linkReport a problemAsk AstroTutorSave questionRefer to the exhibit. What is this rule intended to match?AFailed VPN logon attempts from three or more different outside countries.BFailed VPN logon attempts from three or more different sources inside the home country.CExcessive VPN logon failures from a source inside the home country.DFailed VPN logon events from a source outside the home country.Show AnswerAnswerExplanationThe rule selects VPN logon failure events where the source country is outside the defined home-country set. It requires at least three matching events for each Source IP and User grouping, indicating repeated failed VPN logon activity from an external source.Show comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion