Increase in Job-Related Site Visits

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Day
Deduplication Period	1 Day
Required Data	Requires all of the following: Palo Alto Networks Firewall EAL Logs OR Palo Alto Networks Firewall threat Logs Palo Alto Networks Firewall EAL Logs OR XDR Agent
Detection Modules	Identity Threat Module, SaaS Threat Detection
ATT&CK Tactic	Reconnaissance (TA0043)
ATT&CK Technique	Search Open Websites/Domains (T1593)
Severity	Informational

Description

A user has visited multiple job-related sites in the past day.

Attacker's Goals

This may be an early indicator of an insider threat.

Investigative actions

• Investigate the domains accessed and how popular they are in the organization.
• Check how long the user has been part of the organization.
• Verify that the user is not part of a department that accesses job sites as part of daily operations.