威胁事件

• 识别 xfe_confirmed_malicious_ips 列表。 如果该类别中发现任何 IP 地址，可以直接将其封禁，或将其作为高可信度的攻击进行上报。
• 查看列表中的 suspicious_ips IP地址统计数据。
  • 如果大多数失败事件都来自同一个 IP 地址，而其余 IP 地址的失败事件数量较少，那么可能是有人在配置了错误的用户名或密码的情况下运行了脚本或应用程序（请识别从该 IP 地址访问的有效用户名）。 此外，请查看故障原因，并 top5_affected_data_applicationname 确认是否属于已知问题之一。
  • 如果可疑IP列表中有多个IP的故障次数显著增加，那么极有可能是遭受了攻击。 请在警报中识别出相关IP top5_geoip_country_name ，并分别统计高故障可疑IP的国家分布和用户名分布。
  • 如果故障仅出现在某个特定应用程序中，那么可能是由于该应用程序配置错误所致。 请咨询应用程序所有者。
• 对于身份验证事件，如果大多数失败原因中包含类似 INVALID_CREDS 的字符串，则可能属于攻击行为。

• 如果不确定是否为攻击，请监控流量。 请判断用户名或密码验证失败的流量是否有所增加。
• 如果确认是攻击，请在 anomalous_suspicious_ips 属性中屏蔽这些 IP 地址。
• 从可疑IP地址成功登录的账户可能已遭入侵。 与每个可疑 IP 地址对应的、可能已遭泄露的用户名可在 属性中 compromised_users 找到。 对于已遭入侵的账户，请决定是重置密码还是停用这些账户。

{
  "rule_id": "CREDENTIAL_STUFFING_SSO",
  "rule_name": "Potential credential stuffing attack (SSO)",
  "summary": "Potential credential stuffing attack (SSO): 31348 anomalous events are observed, beyond normal traffic volume, from 2022-11-23 17:00:00 UTC to 2022-11-23 18:00:00 UTC.",
  "source": "[('tenantid', '874f131f-79a9-4581-b078-de7681091fbc'), ('tenantname', 'tenant1.abc.com'), ('data.result', 'failure')]",
  "component": "Login activity",
  "anomalous_event_count": 31348,
  "normal_traffic_volume": 1004,
  "start_time": 1669222800000,
  "end_time": 1669226400000,
  "date": "2022-11-23",
  "severity": "critical",
  "index": "event-sso-*",
  "impacted_user_count": 32090,
  "impacted_apps_count": 5,
  "suspicious_ips": "[['ip', 'fail_percentage', 'failure_count', 'success_count'], 
  ['52.117.163.162', 98.72, 10517, 136], ['169.50.223.22', 98.53, 5502, 82], ['169.50.223.24', 98.42, 5431, 87], 
  ['169.59.129.120', 98.44, 5242, 83], ['169.59.129.116', 98.67, 5185, 70]]",
  "anomalous_suspicious_ips": [
    "169.50.223.22",
    "169.50.223.24",
    "169.59.129.116",
    "169.59.129.120",
    "52.117.163.162"
  ],
  "compromised_users": "{'52.117.163.162': ['Aroh@gmail.com', 'Carb@aol.com', 'Sha@gmail.com'], '169.50.223.24': ['Thar@univ.jfn.ac.lk', 'Tn@gmail.com', 'ain@gmail.com'], '169.59.129.120': ['IBM@mailinator.com', '118@umail.ucc.ie', '229@qq.com', '405@qq.com'], '169.50.223.22': ['IBM@mailinator.com', '4A8@stust.edu.tw', '4A8@stust.edu.tw'], '169.59.129.116': ['IBM@mailinator.com', '202@student.act.edu']}",
  "xfe_threat_insight": "Found 1 known malicious IPs, having categories: anonsvcs: 0, bots: 0, c2server: 0, mw: 1, scanning: 0.",
  "xfe_confirmed_malicious_ips": ['52.117.163.162'],
  ],
  "top5_affected_tenantname": "{'tenant1.abc.com': 32352}",
  "most_significant_tenantname": [
    "tenant1.abc.com"
  ],
  "top5_affected_data_subtype": "{'oidc': 32352}",
  "most_significant_data_subtype": [
    "oidc"
  ],
  "top5_affected_data_scope": "{'openid': 32352}",
  "most_significant_data_scope": [
    "openid"
  ],
  "top5_affected_data_cause": "{'CSIAQ0264E The user name or password is invalid.': 32321, 'CSIAQ0264E El nombre de usuario o la contraseña no es válido.': 12, 'CSIAQ0264E O nome do usuário ou a senha é inválida.': 9, 'CSIAQ0264E 用户名或密码无效。': 4, 'CSIAQ0264E 사용자 이름 또는 비밀번호가 올바르지 않습니다.': 2}",
  "most_significant_data_cause": [
    "CSIAQ0264E The user name or password is invalid."
  ],
  "top5_affected_data_applicationname": "{'urx_next': 31877, 'ABC_PROD_CLOUD': 347, 'ABC Cloud IAM production - global': 117, 'ABC Cloud IAM staging - global': 7, 'ABC Cloud IAM integrationtest': 4}",
  "most_significant_data_applicationname": [
    "urx_next"
  ],
  "top5_affected_data_client_name": "{'urx_next': 31877, 'ABC_PROD_CLOUD': 347, 'ABC Cloud IAM production - global': 117, 'ABC Cloud IAM staging - global': 7, 'ABC Cloud IAM integrationtest': 4}",
  "most_significant_data_client_name": [
    "urx_next"
  ],
  "top5_affected_data_redirecturl": "{'UNKNOWN': 32352}",
  "most_significant_data_redirecturl": [
    "UNKNOWN"
  ],
  "top5_affected_data_providerid": "{}",
  "most_significant_data_providerid": [],
  "top5_affected_data_username": "{'wsa@ibm.com': 319, 'arm@gmail.com': 17, 'armo@gmail.com': 9, '123@mail.ru': 6, 'e_epps@ymail.com': 6}",
  "most_significant_data_username": [
    "wsa@ibm.com"
  ],
  "top5_affected_geoip_country_name": "{'United States': 32334, 'Australia': 17, 'United Kingdom': 1}",
  "most_significant_geoip_country_name": [
    "United States"
  ]
}

• 检查 xfe_confirmed_malicious_ips 列表，若检测结果为正，则屏蔽该IP地址。
• top5_affected_data_usernametop5_affected_data_cause查看该小时内生成的“多次登录失败”警报数量，然后确定、top5_affected_data_applicationname、和。
  • 如果流量来自某个特定应用程序和某个特定用户，那么可能是有人配置了错误的用户名/密码，并为此运行了某个脚本。 确认这是合法流量还是非法流量。
  • 如果流量来自多个用户，请屏蔽该 IP 地址（除非是 VPN 或代理 IP 地址）。 如果该 IP 地址是 VPN 或代理 IP，请进行排查 top5_affected_data_cause ，以确定是否由任何运行问题引起。
  • 如果在一小时内发现多个警报，请针对每个警报进行 top5_affected_data_username 识别 top5_affected_tenantname 。 如果某个租户的多个 IP 地址出现大量故障，且这些故障来自多个用户，则可能是遭受了攻击，或是应用程序或系统发生了重大故障。

• 如果不确定是否为攻击，请监控流量以判断故障是减少还是增加。
• 如果确认是攻击，请在 anomalous_suspicious_ips 属性中屏蔽这些 IP 地址。
• 从可疑IP地址成功登录的账户可能已遭入侵。 与每个可疑 IP 地址对应的、可能已遭泄露的用户名可在 属性中 compromised_users 找到。 对于已遭入侵的账户，请决定是重置密码还是停用这些账户。

{
    "rule_id": "MULTIPLE_FAILED_LOGIN_AUTH",
    "rule_name": "Multiple failed login from an IP address (Auth)",
    "summary": "Multiple failed login from an IP address (Auth): 5597 anomalous events are observed, beyond normal traffic volume, from 2023-01-10 17:00:00 UTC to 2023-01-10 18:00:00 UTC.",
    "source": "[('data.origin', '165.155.173.54'), ('data.result', 'failure')]",
    "component": "Login activity",
    "anomalous_event_count": 5597,
    "normal_traffic_volume": 0,
    "start_time": 1673370000000,
    "end_time": 1673373600000,
    "date": "2023-01-10",
    "severity": "critical",
    "index": "event-authentication-*",
    "impacted_user_count": 17,
    "suspicious_ips": "[['ip', 'fail_percentage', 'failure_count', 'success_count'], ['165.155.173.54', 98.45, 5597, 88]]",
    "anomalous_suspicious_ips": [
      "165.155.173.54"
    ],
    "compromised_users": "{'165.155.173.54': ['serafina', 'alessi', 'donyg', 'evanb', 'joelr', 'taqb', 'anthony', 'heaven', 'jenny', 'jessica']}",
    "xfe_threat_insight": "Found 0 known malicious IPs.",
    "xfe_confirmed_malicious_ips": [],
    ],
    "top5_affected_tenantname": "{'tenant1.abc.com': 5593, 'tenant2.abc.com': 4}",
    "most_significant_tenantname": [
      "idpcloud.nycenet.edu"
    ],
    "top5_affected_data_subtype": "{'user_password': 5596, 'mfa': 1}",
    "most_significant_data_subtype": [
      "user_password"
    ],
    "top5_affected_data_scope": "{}",
    "most_significant_data_scope": [],
    "top5_affected_data_cause": "{'The system failed to authenticate user \"aariz\" because of \"INVALID_CREDS\".': 5579, 
    'The system failed to authenticate user \"anthony\" because of \"INVALID_CREDS\".': 2, 
    'The system failed to authenticate user \"mtorr\" because of \"INVALID_CREDS\".': 2, 
    'CSIAH2417E The one-time password that you submitted was invalid. Submit a valid one-time password.': 1, 
    'The system failed to authenticate user \"aless\" because of \"INVALID_CREDS\".': 1}",
    "most_significant_data_cause": [
      "The system failed to authenticate user \"aari\" because of \"INVALID_CREDS\"."
    ],
    "top5_affected_data_sourcetype": "{'clouddirectory': 5596}",
    "most_significant_data_sourcetype": [
      "clouddirectory"
    ],
    "top5_affected_data_providerid": "{}",
    "most_significant_data_providerid": [],
    "top5_affected_data_grant_type": "{}",
    "most_significant_data_grant_type": [],
    "top5_affected_data_mfamethod": "{'SMS OTP': 1}",
    "most_significant_data_mfamethod": [
      "SMS OTP"
    ],
    "top5_affected_data_username": "{'aari': 5579, 'anthony': 2, 'mtor': 2, 'ANor': 1, 'aless': 1}",
    "most_significant_data_username": [
      "aari"
    ],
    "top5_affected_geoip_country_name": "{'United States': 5597}",
    "most_significant_geoip_country_name": [
      "United States"
    ]
}

• 如果不确定是否为攻击，请监控流量以判断故障是减少还是增加。
• 如果确认是攻击，请在 anomalous_suspicious_ips 属性中屏蔽这些 IP 地址。
• 从可疑IP地址成功登录的账户可能已遭入侵。 与每个可疑 IP 地址对应的、可能已遭泄露的用户名可在 属性中 compromised_users 找到。 对于已遭入侵的账户，请决定是重置密码还是停用这些账户。

{
    "rule_id": "TENANT_FAILED_SSO_EVENTS",
    "rule_name": "Abnormal number of failed SSO events observed per tenant.",
    "summary": "Abnormal number of failed SSO events observed per tenant.: 24456 anomalous events are observed, beyond normal traffic volume, from 2022-12-19 10:00:00 UTC to 2022-12-19 11:00:00 UTC.",
    "source": "[('tenantid', '874f131f-79a9-4581-b078-de7681091fbc'), ('tenantname', 'tenant1.abc.com'), ('data.result', 'failure')]",
    "component": "Login activity",
    "anomalous_event_count": 24456,
    "normal_traffic_volume": 711,
    "start_time": 1671444000000,
    "end_time": 1671447600000,
    "date": "2022-12-19",
    "severity": "critical",
    "index": "event-sso-*",
    "impacted_user_count": 88,
    "impacted_apps_count": 37,
    "suspicious_ips": "[['ip', 'fail_percentage', 'failure_count', 'success_count'], 
    ['177.241.73.204', 100.0, 24777, 0], ['129.42.21.2', 100.0, 26, 0], ['129.42.18.2', 100.0, 24, 0], 
    ['129.42.19.2', 100.0, 24, 0], ['89.64.54.76', 100.0, 19, 0], ['52.116.134.146', 100.0, 12, 0], 
    ['122.161.79.4', 100.0, 11, 0]]",
    "anomalous_suspicious_ips": [
      "122.161.79.4",
      "177.241.73.204",
      "89.64.54.76"
    ],
    "xfe_threat_insight": "Found 1 known malicious IPs, having categories: anonsvcs: 0, bots: 1, c2server: 0, mw: 0, scanning: 0`",
    "xfe_confirmed_malicious_ips": ['122.161.79.4'],
    ],
    "top5_affected_tenantname": "{'tenant1.abc.com': 25167}",
    "most_significant_tenantname": [
      "tenant1.abc.com"
    ],
    "top5_affected_data_subtype": "{'oidc': 25167}",
    "most_significant_data_subtype": [
      "oidc"
    ],
    "top5_affected_data_scope": "{'openid email': 24790, 'openid': 259, 'openid profile': 2, 'openid profile email': 1}",
    "most_significant_data_scope": [
      "openid email"
    ],
    "top5_affected_data_cause": "{'CSIAQ0178E Login is required. The request cannot be processed without authentication.': 24777, 
    'CSIAQ0278E User is not authorized to access the application due to policy constraints.': 150, 
    'CSIAQ0158E The [authorization_grant] of type [authorization_code] does not exist or is invalid.': 70, 
    'CSIAQ0158E The [authorization_grant] of type [refresh_token] does not exist or is invalid.': 31, 
    'CSIAQ0158E タイプ [refresh_token] の [authorization_grant] は存在しないか無効です。': 13}",
    "most_significant_data_cause": [
      "CSIAQ0178E Login is required. The request cannot be processed without authentication."
    ],
    "top5_affected_data_applicationname": "{'Gaz-HAT-Production': 24777, 'abc-refresh-service-prod': 107, 'ABCProductionOIDC': 72, 'ABC Publisher': 63, 'FastPassPRDClient': 30}",
    "most_significant_data_applicationname": [
      "Gaz-HAT-Production"
    ],
    "top5_affected_data_client_name": "{'ABC-HAT-Production': 24777, 'ABCrefresh-service-prod': 107, 'ABCProductionOIDC': 72, 'abc Publisher': 63, 'abcFastPassPRDClient': 30}",
    "most_significant_data_client_name": [
      "Gaz-HAT-Production"
    ],
    "top5_affected_data_redirecturl": "{'https://gaz.tuc.stglabs.ibm.com/oidc/callback/': 24777, 'https://w3-authorization-service.us-south-k8s.intranet.ibm.com/sso/callback': 88, 'https://w3.ibm.com/w3publisher/redirect.html': 63, 'UNKNOWN': 50, 'https://fastpass.w3cloud.ibm.com:443/oidcclient/redirect/FastPassPRDClient': 30}",
    "most_significant_data_redirecturl": [
      "https://gaz.tuc.stglabs.ibm.com/oidc/callback/"
    ],
    "top5_affected_data_providerid": "{}",
    "most_significant_data_providerid": [],
    "top5_affected_data_username": "{'UNKNOWN': 24978, 'katar@ocean.ibm.com': 19, 'Jaya@ocean.ibm.com': 17, 'shiv@ocean.ibm.com': 11, 'Neha@ocean.ibm.com': 10}",
    "most_significant_data_username": [
      "UNKNOWN"
    ],
    "top5_affected_geoip_country_name": "{'Mexico': 24777, 'United States': 192, 'India': 84, 'Poland': 26, 'Japan': 22}",
    "most_significant_geoip_country_name": [
      "Mexico"
    ]
}

• 判断是否存在针对单个租户在同一时间段内收到多条警报的情况。 如果是，请检查该租户是否存在已知的运行问题；否则，请查看 属性 top5_affected_data_applicationname 以确定触发警报的应用程序。
• 如果警报连续数小时来自同一来源（即同一租户 URL 和用户名），则可以对该用户实施一定时长的封禁（例如 24 小时）。
• 查看IP地址和应用程序名称的分布情况，以判断是否为分布式攻击。

• 如果不确定是否为攻击，请监控流量。 请判断用户名或密码验证失败的流量是否有所增加。
• 如果检测到可疑流量，则应主动采取补救措施，封禁触发警报的账户。

{
    "rule_id": "FREQUENT_AUTH_SINGLEUSER_AUTH",
    "rule_name": "Frequent authentication from single user (Auth)",
    "summary": "Frequent authentication from single user (Auth): 16283 anomalous events are observed, beyond normal traffic volume, from 2022-12-26 10:00:00 UTC to 2022-12-26 11:00:00 UTC.",
    "source": "[('tenantid', '874f131f-79a9-4581-b078-de7681091fbc'), ('data.username', 'MSurk'), ('data.result', 'success')]",
    "component": "Login activity",
    "anomalous_event_count": 16283,
    "normal_traffic_volume": 0,
    "start_time": 1672048800000,
    "end_time": 1672052400000,
    "date": "2022-12-26",
    "severity": "critical",
    "index": "event-authentication-*",
    "impacted_user_count": 1,
    "anomalous_suspicious_ips": [
      "12.153.148.57"
    ],
    "top5_affected_tenantname": "{'tenant1.abc.com': 16283}",
    "most_significant_tenantname": [
      "tenant1.abc.com"
    ],
    "top5_affected_data_cause": "{'Authenticated user \"MSurk\" successfully.': 16283}",
    "most_significant_data_cause": [
      "Authenticated user \"MSurk\" successfully."
    ],
    "top5_affected_data_subtype": "{'user_password': 16283}",
    "most_significant_data_subtype": [
      "user_password"
    ],
    "top5_affected_data_scope": "{}",
    "most_significant_data_scope": [],
    "top5_affected_data_sourcetype": "{'clouddirectory': 16283}",
    "most_significant_data_sourcetype": [
      "clouddirectory"
    ],
    "top5_affected_data_origin": "{'12.153.148.57': 16283}",
    "most_significant_data_origin": [
      "12.153.148.57"
    ],
    "top5_affected_data_providerid": "{}",
    "most_significant_data_providerid": [],
    "top5_affected_data_grant_type": "{}",
    "most_significant_data_grant_type": [],
    "top5_affected_data_mfamethod": "{}",
    "most_significant_data_mfamethod": [],
    "top5_affected_data_username": "{'MSurk': 16283}",
    "most_significant_data_username": [
      "MSurk"
    ],
    "top5_affected_geoip_country_name": "{'United States': 16283}",
    "most_significant_geoip_country_name": [
      "United States"
    ]
}

• 此警报由管理事件触发。 如果发现任何警报，请检查该警报是否来自有效用户。 如果用户身份有效，则识别身份验证类型 (top5_affected_data_mfamethod) 以及已注册的设备数量 (anomalous_event_count)。若发现可疑情况，请采取相应措施。

• 如果不确定是否为攻击，请监控流量。 请判断用户名或密码验证失败的流量是否有所增加。
• 如果检测到可疑流量，则应主动采取补救措施，封禁触发警报的账户。
• 如果用户被识别为可疑用户，系统将对其进行封禁，或者按照访问策略规则中的规定继续执行操作。 更多详情请参阅 “基于威胁的用户封锁 ”。

{
    "rule_name": "Abnormal number of device enrollments",
    "rule_id": "ABNORMAL_DEVICE_ENROLLMENT",
    "summary": "Abnormal number of device enrollments: 20 anomalous events are observed, beyond normal traffic volume, from 2023-01-12 17:00:00 UTC to 2023-01-12 18:00:00 UTC.",
    "severity": "critical",
    "date": "2023-01-12",
    "start_time": "2023-01-12 17:00:00",
    "end_time": "2023-01-12 18:00:00",
    "component": "Login activity",
    "normal_traffic_volume": 0,
    "anomalous_event_count": 20,
    "impacted_user_count": 1,
    "index": "event-management-*", 
    "most_significant_data_subject": ["326000DLNK"],
    "most_significant_data_origin": [
      "129.41.58.3"
    ],
    "top5_affected_data_username": "{'Henry': 20}",
    "source": "[('data.mfamethod', 'Voice OTP'), ('data.username', 'Henry')]",
    "most_significant_data_mfamethod": [
      "Voice OTP"
    ],
    "most_significant_geoip_country_name": [
      "United States"
    ],
    "most_significant_data_grant_type": [],
    "top5_affected_tenantname": "{'tenant1.abc.com': 20}",
    ],
    "most_significant_tenantname": [
      "tenant1.abc.com"
    ],
    "top5_affected_data_origin": "{'129.41.58.3': 20}",
    "anomalous_suspicious_ips": [
      "129.41.58.3"
    ],
    "top5_affected_geoip_country_name": "{'United States': 20}",
    "top5_affected_data_grant_type": "{}",
    "top5_affected_data_mfamethod": "{'Voice OTP': 20}",
    "most_significant_data_username": [
      "Henry"
    ]
}

• 通过 form top5_affected_data_username 属性的凭据，判断该 IP 是否正试图利用被盗凭据访问多个用户。 如果是，则可以暂时封禁该IP地址。
• 如果在一小时内从多个 IP 地址检测到多条警报，或者同一 IP 地址被 Multiple_failed_login 或 credential_stuffing 规则检测到，则可能是暴力破解攻击或凭证填充攻击。

• 如果不确定是否为攻击，请监控流量。 请判断用户名或密码验证失败的流量是否有所增加。
• 如果发现攻击期间有部分用户账户曾被同一IP地址成功访问，请将该用户从所有活跃会话中注销，并提示其更改密码；或者作为主动补救措施，暂时封禁该用户。
• 如果多个用户使用被盗凭据从该 IP 地址登录，请在 属性中 source 屏蔽该 IP 地址。

{
    "rule_id": "COMPROMISED_CREDENTIALS",
    "rule_name": "Multiple use of compromised credentials",
    "summary": "Multiple use of compromised credentials: 100 anomalous events are observed, beyond normal traffic volume, from 2023-02-08 21:00:00 UTC to 2023-02-08 22:00:00 UTC.",
    "source": "[('data.origin', '129.41.58.3'), ('data.dict_type', 'GLOBAL')]",
    "component": "Login activity",
    "severity": "critical",
    "impacted_user_count": 1,
    "anomalous_event_count": 100,
    "normal_traffic_volume": 0,
    "date": "2023-02-08",
    "top5_affected_data_scope": "{}",
    "rule_attribute": "compromised_credentials",
    "top5_affected_data_username": "{'Henry': 100}",
    "start_time": "2023-02-08 21:00:00",
    "end_time": "2023-02-08 22:00:00",
    "index": "event-authentication-*",
    "most_significant_data_mfamethod": [],
    "most_significant_geoip_country_name": [
        "United States"
    ],
    "most_significant_data_grant_type": [],
    "top5_affected_tenantname": "{'tenant1.abc.com': 100}",
    "top5_affected_data_providerid": "{}",
    ],
    "most_significant_tenantname": [
        "tenant1.abc.com"
    ],
    "most_significant_data_sourcetype": [
        "clouddirectory"
    ],
    "most_significant_data_scope": [],
    ],
    "top5_affected_data_subtype": "{'user_password': 100}",
    "most_significant_data_subtype": [
        "user_password"
    ],
    "most_significant_data_providerid": [],
    "top5_affected_geoip_country_name": "{'United States': 100}",
    "top5_affected_data_grant_type": "{}",
    "top5_affected_data_mfamethod": "{}",
    "top5_affected_data_sourcetype": "{'clouddirectory': 100}",
    "most_significant_data_username": [
        "Henry"
    ]
}

• 根据该运行问题，可能需要在 Verify 管理控制台上进行配置更改，或者需要 Verify 支持团队的协助。

{
    "rule_id": "CAUSE_OF_SSO_FAILURE",
    "rule_name": "Grouping by the cause of failure (SSO)",
    "summary": "Grouping by the cause of failure (SSO): 11314 anomalous events are observed, beyond normal traffic volume, from 2023-01-18 15:00:00 UTC to 2023-01-18 16:00:00 UTC.",
    "source": "[('data.cause', 'CSIAC5061E An unexpected error has occurred with a protocol module com.tivoli.am.fim.fedmgr2.protocol.GenericPocAuthenticationDelegateProtocol.'), ('data.result', 'failure')]",
    "component": "Login activity",
    "anomalous_event_count": 11314,
    "normal_traffic_volume": 1595,
    "start_time": 1674054000000,
    "end_time": 1674057600000,
    "date": "2023-01-18",
    "severity": "critical",
    "index": "event-sso-*",
    "impacted_user_count": 7774,
    "impacted_apps_count": 20,
    ],
    "top5_affected_tenantname": "{'tenant1.abc.com': 11057, 'tenant2.abc.com': 1852}",
    "most_significant_tenantname": [
      "tenant1.abc.com"
    ],
    "top5_affected_data_subtype": "{'saml': 12420, 'WS-Fed': 489}",
    "most_significant_data_subtype": [
      "saml"
    ],
    "top5_affected_data_scope": "{}",
    "most_significant_data_scope": [],
    "top5_affected_data_cause": "{'CSIAC5061E An unexpected error has occurred with a protocol module com.tivoli.am.fim.fedmgr2.protocol.GenericPocAuthenticationDelegateProtocol.': 12909}",
    "most_significant_data_cause": [
      "CSIAC5061E An unexpected error has occurred with a protocol module com.tivoli.am.fim.fedmgr2.protocol.GenericPocAuthenticationDelegateProtocol."
    ],
    "top5_affected_data_applicationname": "{'ABC-365': 320, 'Google.com': 67}",
    "most_significant_data_applicationname": [
      "ABC-365"
    ],
    "top5_affected_data_client_name": "{}",
    "most_significant_data_client_name": [],
    "top5_affected_data_redirecturl": "{}",
    "most_significant_data_redirecturl": [],
    "top5_affected_data_providerid": "{'UNKNOWN': 12472, 'urn:federation:MicrosoftOnline': 323}",
    "most_significant_data_providerid": [
      "UNKNOWN"
    ],
    "top5_affected_data_username": "{'UNKNOWN': 86, 'jer@abc.com': 60, 'crow@abc.com': 31, 'julia': 20, 'Bryan': 11}",
    "most_significant_data_username": [
      "UNKNOWN",
      "jer@abc.com",
      "crow@abc.com"
    ],
    "top5_affected_geoip_country_name": "{'United States': 12295, 'India': 178, 'Canada': 84, 'United Kingdom': 72, 'Mexico': 36}",
    "most_significant_geoip_country_name": [
      "United States"
    ]
}