Static Policies to Detect Threats

Table of Contents

Learn about the static policies in Behavior Threats for identifying potential threats.

We initially introduced the static policies as predefined user activity policies in the Data Security product. These original versions are no longer available for newly provisioned tenants and will soon be deprecated for all tenants. If you're currently using the legacy predefined policies, we recommend that you transition to the new policies. By transitioning to the new policies, you ensure continued functionality and access to the latest features.

Static Policies

Policy Name	Description
Inactive Account Access	Instructs Behavior Threats to show when a user accesses an app by using an inactive account. This policy considers an account inactive if the account wasn’t accessed in over 30 days. Inactive account access might indicate that the user’s account was breached.
Impossible Traveler	Instructs Behavior Threats to show when a user accesses an app from different locations within a time frame that couldn’t accommodate travel between the locations. This policy determines the locations by IP addresses. This impossible travel might indicate that the user’s account is compromised.
Login Failures	Instructs Behavior Threats to show when a user has multiple failed login attempts to an app. Multiple login failures might indicate an attempt to breach the user account. For this policy, Behavior Threats logs incidents if there are more than 5 consecutive failed login attempts within 30 minutes.
Malware Detection	Instructs Behavior Threats to show when a user interacts with a file that contains malware. This activity might identify a malicious user and is a threat to your organization.
Risky IPs	Instructs Behavior Threats to show when a user accesses an app from a suspicious IP address. Suspicious IP addresses include malicious IP addresses identified by Unit 42, the Palo Alto Networks threat intelligence team. Suspicious IP addresses also include IP addresses of known Tor exit nodes and IP addresses belonging to Bulletproof Hosting Providers (BHPs). Access from a risky IP address likely indicates that the user’s account was breached.
Unsafe Location	Instructs Behavior Threats to show when a user accesses an app from a country that the United States Department of the Treasury considers unsafe. These countries are considered unsafe because they are known origins of cyberattacks. User access from an unsafe location likely indicates that the user’s account was breached.
Unsafe VPN	Instructs Behavior Threats to show when a user accesses an app from an unauthorized or unsanctioned VPN. These unsafe VPNs include personal VPNs and known consumer VPNs. The use of an unsafe VPN might indicate that the user is hiding their IP address to avoid auditing and tracking. The use of an unsafe VPN might also indicate that a malicious actor is attempting to decrypt traffic to steal user credentials.

SaaS Security Docs

Static Policies to Detect Threats

SaaS Security Docs

Static Policies to Detect Threats

Static Policies

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Visibility & Monitoring

Best Practices

Experts Corner

Technical Documentation

Company

Legal Notices