First Seen SonicWall Remote Access Login by User and Source

Last updated 5 days ago on 2026-08-21

Created 5 days ago on 2026-08-21

About

Identifies a successful SonicWall VPN- or WAN-zone administrator or remote-user login from a source IP that was not previously observed with the same user on the same appliance during the prior 14 days. This may indicate stolen credentials, compromised administrator access, or unauthorized remote access.

Tags

Domain: NetworkDomain: IdentityUse Case: Threat DetectionUse Case: Identity and Access AuditTactic: Initial AccessData Source: SonicWall Firewall LogsRule Type: New TermsLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

↳ External Remote Services (T1133)(external, opens in a new tab or window)

False Positive Examples

New administrators or VPN users, travel, mobile networks, ISP address rotation, managed service providers, and first observations after integration onboarding or retention loss can trigger this rule.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-sonicwall_firewall.log-*
Related Integrations: sonicwall_firewall(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:"sonicwall_firewall.log" and
  event.action:"login-success" and
  event.code:("235" or "236" or "237" or "238" or "1080") and
  source.ip:* and user.name:* and observer.serial_number:*

Install detection rules in Elastic Security

Detect First Seen SonicWall Remote Access Login by User and Source in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).