Successful Sign-In With No Corresponding Endpoint Telemetry

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•0

Detects a successful authentication event where standard endpoint identification metadata (endpoint name and IP address) is absent. This often indicates logs originating from sources without proper endpoint telemetry integration or potential attempts to obfuscate the source of an authentication request.