{
  "integration": "REPLACE_WITH_PORTAL_AUDIT_INTEGRATION_UUID",
  "resource": {
    "enabled": true,
    "status": "experimental",
    "level": "high",
    "logsource": {
      "product": "portal-audit",
      "category": "authentication",
      "service": "portal"
    },
    "detection": {
      "condition": "selection and not filter_corporate_ranges",
      "selection": {
        "event.dataset": "portal-audit",
        "event.action": "authentication-failure",
        "user.roles|contains": "admin"
      },
      "filter_corporate_ranges": {
        "source.ip|cidr": [
          "10.0.0.0/8",
          "172.16.0.0/12",
          "192.168.0.0/16"
        ]
      }
    },
    "metadata": {
      "title": "Portal administrative sign-in failed from {{ source.ip }}",
      "author": "Security engineering",
      "description": "A sign-in to the internal portal by an account holding the admin role failed from an address outside the corporate ranges.",
      "references": [
        "https://attack.mitre.org/techniques/T1078/"
      ]
    },
    "mitre": {
      "tactic": ["TA0001", "TA0006"],
      "technique": ["T1078", "T1110"],
      "subtechnique": ["T1078.003"]
    },
    "compliance": {
      "pci_dss": ["8.3.1", "10.2.4"],
      "iso_27001": ["A.8.5"],
      "nist_800_53": ["AC-7", "AU-6"]
    },
    "tags": [
      "attack.initial-access",
      "attack.credential-access",
      "attack.t1078",
      "attack.t1110"
    ],
    "falsepositives": [
      "Administrators signing in from home or from a mobile network during a password change"
    ]
  }
}