Huntress Alert: Login from Unexpected Country

Huntress Alert: Login from Unexpected Country

Login from Unexpected Country

If alert trigger for "Login from unexpected country" from select the alert in dashboard.

In scope section,
we may select it for all organization or for particular organization. 

Steps to Resolve

There are two ways to resolve this escalation using the Response section below:

  1. Add an Expected or Unauthorized rule at the Account or Organization level.
  2. Add an Expected or Unauthorized rule for each individual Identity in the escalation.

Marking a location Expected resolves the escalation. Marking a location Unauthorized automatically logs out and disables the target identities and will log out and disable these identities in the future. This may result in multiple reports for users in an ADSync environment.