Instructs Behavior Threats to show when a user accesses an app by using an inactive account. This policy considers an account inactive if the account wasn’t accessed in over 30 days. Inactive account access might indicate that the user’s account was breached.

Instructs Behavior Threats to show when a user accesses an app from different locations within a time frame that couldn’t accommodate travel between the locations. This policy determines the locations by IP addresses. This impossible travel might indicate that the user’s account is compromised.

Instructs Behavior Threats to show when a user has multiple failed login attempts to an app. Multiple login failures might indicate an attempt to breach the user account.

For this policy, Behavior Threats logs incidents if there are more than 5 consecutive failed login attempts within 30 minutes.

Instructs Behavior Threats to show when a user interacts with a file that contains malware. This activity might identify a malicious user and is a threat to your organization.

Instructs Behavior Threats to show when a user accesses an app from a suspicious IP address. Suspicious IP addresses include malicious IP addresses identified by Unit 42, the Palo Alto Networks threat intelligence team. Suspicious IP addresses also include IP addresses of known Tor exit nodes and IP addresses belonging to Bulletproof Hosting Providers (BHPs). Access from a risky IP address likely indicates that the user’s account was breached.

Instructs Behavior Threats to show when a user accesses an app from a country that the United States Department of the Treasury considers unsafe. These countries are considered unsafe because they are known origins of cyber attacks. User access from an unsafe location likely indicates that the user’s account was breached.

Instructs Behavior Threats to show when a user accesses an app from an unauthorized or unsanctioned VPN. These unsafe VPNs include personal VPNs and known consumer VPNs. The use of an unsafe VPN might indicate that the user is hiding their IP address to avoid auditing and tracking. The use of an unsafe VPN might also indicate that a malicious actor is attempting to decrypt traffic to steal user credentials.