UBA : External User Failed Mailbox Login

The QRadar® User Behavior Analytics (UBA) app supports use cases based on rules for certain behavioral anomalies.

UBA : External User Failed Mailbox Login

Enabled by default

False

Default senseValue

10

Description

Detects repeated failures to log in to mailbox from an external user.

Support rules

BB:UBA : Common Event Filters

Log source types

Microsoft Office 365 (EventID: MailboxLogin-false)