Unusual Badge Reader Access

Description

Triggered when a badge attempts to access a badge reader that it has historically not accessed. This is based on location and the badge (or user) baseline history.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Insider Threat, Security Monitoring, Compliance

Category

Insider Threat

Alert Volume

Low

Journey

Stage 4

MITRE ATT&CK Tactics

Reconnaissance

MITRE ATT&CK Techniques

Gather Victim Org Information
Determine Physical Locations

Data Sources

Physical Security