IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [8.4] ›Detections and alerts ›Prebuilt rule reference
« O365 Email Reported by User as Malware or Phish O365 Exchange Suspicious Mailbox Right Delegation »

O365 Excessive Single Sign-On Logon Errorsedit

Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token.

Rule type: threshold

Rule indices:

  • filebeat-*
  • logs-o365*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-20m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

Tags:

  • Elastic
  • Cloud
  • Microsoft 365
  • Continuous Monitoring
  • SecOps
  • Identity and Access

Version: 6 (version history)

Added (Elastic Stack release): 7.14.0

Last modified (Elastic Stack release): 8.4.0

Rule authors: Elastic, Austin Songer

Rule license: Elastic License v2

Potential false positivesedit

Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.

Investigation guideedit












Rule queryedit








event.dataset:o365.audit and event.provider:AzureActiveDirectory and
event.category:authentication and
o365.audit.LogonError:"SsoArtifactInvalidOrExpired"











Threat mappingedit




Framework: MITRE ATT&CKTM














Rule version historyedit










Version 6 (8.4.0 release)








    

  • 
Formatting only

    • 









Version 4 (8.1.0 release)








    

  • 
Formatting only

    • 









Version 3 (8.0.0 release)








    

  • 

    Updated query, changed from:
    

    

    

    event.dataset:o365.audit and event.provider:AzureActiveDirectory and
event.category:web and
o365.audit.LogonError:"SsoArtifactInvalidOrExpired"
    

    

    • 









Version 2 (7.15.0 release)








    

  • 
Formatting only

    • 


















« O365 Email Reported by User as Malware or Phish


O365 Exchange Suspicious Mailbox Right Delegation »