AnsweredAssumed Answered

Finding multiple connections from different countries

Question asked by Jeremy Kerwin on Dec 20, 2018
Latest reply on Dec 20, 2018 by Jeremy Kerwin

We're importing our VPN logs into NetWitness and I would like to setup like an alert or report that will trigger when accounts are connecting to VPN from more than one country.

 

e.g. Two logons for jsmith from Indonesia and France, trigger an alert 'Hey they can't possibly be in two places at once'

 

What suggestions do you have to accomplish this?

 

Thanks.

Outcomes