O365 Excessive Sso Logon Errors

Description

This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.

   Help

O365 Excessive Sso Logon Errors Help

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

   Search

Open in Search