topic Login from another country does not trigger anomaly alert in Email and Collaboration

Login from another country does not trigger anomaly alert

Chrischevy — Fri, 03 Jan 2025 20:12:37 GMT

We are migrating our customers from Sonicwall Cloud App Security to Check Point Harmony Email & Collaboration. Sonicwall Cloud App Security is basically an older version of Harmony Email & Collaboration.

With Sonicwall, when a user logged in from another country (during a trip for example), we would receive an alert immediatly. With Check Point, there are no alerts and the logins are all detected as legitimate. The options to customize the Anomaly Detection are pretty limited so there is not much we can change, beside the "Impossible Travel Anomaly".

Shouldn't a login from a new country generate an anomaly alert ?

Thank you for your help

Re: Login from another country does not trigger anomaly alert

Chris_Atkinson — Sat, 04 Jan 2025 09:14:27 GMT

Reviewing the admin guide there should be "First time in new country" & "impossible travel" anomalies amongst others.

From an O365 perspective is the the first login for this user from that country or have they in fact travelled there before?

Within HEC how is the "suspected compromised account workflow" currently set?

Re: Login from another country does not trigger anomaly alert

Chrischevy — Mon, 06 Jan 2025 21:44:00 GMT

Thanks for the reply.

I was able to fix the issue by choosing "Alert admins" under "Suspected compromised accounts workflow".