EBA: Potential Host Lateral Movement Detected on events which are detected by the Local system
The QRadar® User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.
EBA: Potential Host Lateral Movement Detected on events which are detected by the Local system
Enabled by default
True
Default senseValueDestination
5
Default senseValueSource
10
Description
Detects potential lateral movement activity by identifying a source IP communicating with at least 20 different destination IPs within 5 minutes across internal network segments.
Support rules
- BB:UBA : Common Log Source Filters
Log source types
Firewall logs, Network Flow (NetFlow), EDR Telemetry