User new source IP baseline
An account signed in from a source IP never seen for that account during the case's learning window (the first 7 days of its data).
What it detects
An account signed in from a source IP never seen for that account during the case's learning window (the first 7 days of its data). A per-entity novelty baseline computed only from the case's own events - never wall-clock - so a detection re-run is identical. Modest strength on its own (IPs churn), but a useful lead when it lines up with impossible travel, a proxy flag, or off-hours access.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Travel, new devices, VPN exit changes, and DHCP churn all trip first-seen on IPs. Treat as a lead to correlate, not a verdict; raise severity only with corroborating signals. Tune the learning window to the case's span.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 55%. Source: rules/cloud/user_new_source_ip_baseline.yaml, licensed under the Apache License 2.0.
id: cloud.identity.user_new_source_ip_baseline
version: 1.0.0
status: experimental
severity: medium
confidence: 0.55
platforms: [application]
mitre_techniques: [T1078]
description: |
An account signed in from a source IP never seen for that account during the case's
learning window (the first 7 days of its data). A per-entity novelty baseline computed
only from the case's own events - never wall-clock - so a detection re-run is identical
(ADR-023 Phase C). Modest strength on its own (IPs churn), but a useful lead when it
lines up with impossible travel, a proxy flag, or off-hours access.
match:
platform: application
event_category: authentication
event_outcome: success
baseline:
entity: user_name
observe: source_ip
learn_window_days: 7
condition: first_seen
correlation_keys: [user_name]
false_positive_guidance: |
Travel, new devices, VPN exit changes, and DHCP churn all trip first-seen on IPs. Treat
as a lead to correlate, not a verdict; raise severity only with corroborating signals.
Tune the learning window to the case's span.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.